847f8e553b86c08ad25315495a897aaf69395f94f67cc08d6172fc2872b5dc2c | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 04:17

Sharing

Report Analysis Logs

General

Target

3fb985bebc670e237a32097dcad35670.dll
Size

4KB
MD5

3fb985bebc670e237a32097dcad35670
SHA1

550a09205dbb8c879ba95385798cd77f7a32a8a7
SHA256

847f8e553b86c08ad25315495a897aaf69395f94f67cc08d6172fc2872b5dc2c
SHA512

cda2c2565d03f1524c89ebcca9bc52a6b2fbc9cee2b43a7a8d8a66c3fc40a1417a8c2761d5b32adcc036487f5c4c5742bdfaea56986158fd62737cfb41ff683b

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 2976	2880	rundll32.exe	30
PID 2880 wrote to memory of 2976	2880	rundll32.exe	30
PID 2880 wrote to memory of 2976	2880	rundll32.exe	30
PID 2880 wrote to memory of 2976	2880	rundll32.exe	30
PID 2880 wrote to memory of 2976	2880	rundll32.exe	30
PID 2880 wrote to memory of 2976	2880	rundll32.exe	30
PID 2880 wrote to memory of 2976	2880	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3fb985bebc670e237a32097dcad35670.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3fb985bebc670e237a32097dcad35670.dll,#1
  2⤵
  PID:2976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads