6a1bdfae4f1a8518dabad69c758c063e36298151a4f8c9b5ce0d7fedceafaf53 | Triage

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 21:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

packet.dll
Size

2KB
MD5

e9a6fb49219d5c6eb177d28687fcf023
SHA1

321c2a3cc6739db9d55ee3725018e7b5ce96041a
SHA256

508a23fb0ef59c495f7342b8a415a7465fbab79e270b9ad6efa52e8366b57e5e
SHA512

49d096648f8a455cce6fa70b11dc84cb7a7d4c16cf98f9749ef8257eba55cef80d2b74eb81c8745961d4a2f20214a6b3034119f59f0d6edeb386ce9390da8d73

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2552	2528	rundll32.exe	29
PID 2528 wrote to memory of 2552	2528	rundll32.exe	29
PID 2528 wrote to memory of 2552	2528	rundll32.exe	29
PID 2528 wrote to memory of 2552	2528	rundll32.exe	29
PID 2528 wrote to memory of 2552	2528	rundll32.exe	29
PID 2528 wrote to memory of 2552	2528	rundll32.exe	29
PID 2528 wrote to memory of 2552	2528	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\packet.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\packet.dll,#1
  2⤵
  PID:2552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads