64f0803dc343b57b1f9114f1bfb9eeacf9d76b193620621561a280827b0b6326 | Triage

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 19:05

Sharing

Report Analysis Logs

General

Target

402323332/Examples/MyDll.dll
Size

7KB
MD5

f411e074e80d44b924f1cb921a44acdd
SHA1

eb9eb8574672f71af53c6127ffd0fc9e0049b7de
SHA256

f707ae04c81219368a33238e9785bb41dab4b2ff694b42fa79b3764ba43faff0
SHA512

d4db869a9eadf43f2f57c1002bd2709ac393ea095b9dd0575e9040770b437beb8ceaf5df81fd853ff5cf1c13f9649c562c9839f12aa29437e5aad2097df10bc0
SSDEEP

96:nPEEzPZN8j85Ji1sAN0g4dD2sjYlQ+KLmH:n3DZN8WJi1DNHe7wfKLmH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2268	2976	rundll32.exe	30
PID 2976 wrote to memory of 2268	2976	rundll32.exe	30
PID 2976 wrote to memory of 2268	2976	rundll32.exe	30
PID 2976 wrote to memory of 2268	2976	rundll32.exe	30
PID 2976 wrote to memory of 2268	2976	rundll32.exe	30
PID 2976 wrote to memory of 2268	2976	rundll32.exe	30
PID 2976 wrote to memory of 2268	2976	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\402323332\Examples\MyDll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\402323332\Examples\MyDll.dll,#1
  2⤵
  PID:2268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads