12a1ccd84b28812f3e4c26416fc306811dfa0afe702025fd25575f69f14e35a8 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 01:09

Sharing

Report Analysis Logs

General

Target

1ae04738eabc0eb5a48c534b9e62e330N.dll
Size

6KB
MD5

1ae04738eabc0eb5a48c534b9e62e330
SHA1

d2ab9b470b0e2ac903c1b2f8aa4c24d4de58713d
SHA256

12a1ccd84b28812f3e4c26416fc306811dfa0afe702025fd25575f69f14e35a8
SHA512

7578129c2371df213875fe50d2487629a9bbfc1ce73709c93f05c6370d6f3ae3f36d72401e368fef4d0edb01506c909ed2a2c44b1a1ad7b38721dd53fe99bc35
SSDEEP

48:63mll5YVOa9VUX1iwbQWu0KB+BDq9J5SH:VDa9VUX9bQWqB+FqX5SH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2504	2480	rundll32.exe	30
PID 2480 wrote to memory of 2504	2480	rundll32.exe	30
PID 2480 wrote to memory of 2504	2480	rundll32.exe	30
PID 2480 wrote to memory of 2504	2480	rundll32.exe	30
PID 2480 wrote to memory of 2504	2480	rundll32.exe	30
PID 2480 wrote to memory of 2504	2480	rundll32.exe	30
PID 2480 wrote to memory of 2504	2480	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ae04738eabc0eb5a48c534b9e62e330N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ae04738eabc0eb5a48c534b9e62e330N.dll,#1
  2⤵
  PID:2504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads