755d11ba3943ba14071f4bdb5b10d3a1db96fdbf637a2851317304aa2523a4b4 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 09:12

Sharing

Report Analysis Logs

General

Target

DiracLE.dll
Size

268KB
MD5

ce45f9ad921fb1c0cde86485a8fe2b8c
SHA1

784eb77eaa69ffa5741ab92bde82b1e2524d4335
SHA256

705bbf872105d56c548f39923b7a1b7309dde71cd329ac611543650a4fdbd73a
SHA512

25f8e5932b3fdfd7b59bfa73b973738f4da6feb08d1e77714fc613a113ad536795435217591c343f227541a07eb1e2f5bc0eb346a1c9d6f87d19ce4a8316637f
SSDEEP

3072:kCkwXBHGg5FT+eXNdobNz+NFdor2gUbbzslv9oQ7:kUXNdQQ/dor2gUbbzslJ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2124	3012	rundll32.exe	28
PID 3012 wrote to memory of 2124	3012	rundll32.exe	28
PID 3012 wrote to memory of 2124	3012	rundll32.exe	28
PID 3012 wrote to memory of 2124	3012	rundll32.exe	28
PID 3012 wrote to memory of 2124	3012	rundll32.exe	28
PID 3012 wrote to memory of 2124	3012	rundll32.exe	28
PID 3012 wrote to memory of 2124	3012	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DiracLE.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DiracLE.dll,#1
  2⤵
  PID:2124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads