45446f6e7551da01e6b6eca54c82f5584b34fa5b71517e2f3977939dfb0e876b | Triage

Analysis

max time kernel
1442s
max time network
1450s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12-07-2024 01:29

Sharing

Report Analysis Logs

General

Target

System.Data.Common.dll
Size

2.5MB
MD5

d5f0d1298b05b963f7940f7e7134ad2b
SHA1

f8c85d1f24c4603cba29a32d5350640bf4461144
SHA256

aca22c0b307c85a55291d8b11b5227c5c238171c4ca68f66441f9ca1d0e7942f
SHA512

34320a7ba07a30192557e1e5e7965a7a3f463518b735edc3fe79bb29128f21c70c7c93d94acd0e1cb6ea1c7c65761f747b9c2412d2dbf3502aa50a5c8ca5fac3
SSDEEP

49152:BLC7Wo3BjTBKRxy/yiNg9cb8mL1ei0L08Rs85hBhJWBjHbkZe:B0q9cb8mL1ei0L08RseWVHYZe

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 1344	2876	rundll32.exe	29
PID 2876 wrote to memory of 1344	2876	rundll32.exe	29
PID 2876 wrote to memory of 1344	2876	rundll32.exe	29
PID 2876 wrote to memory of 1344	2876	rundll32.exe	29
PID 2876 wrote to memory of 1344	2876	rundll32.exe	29
PID 2876 wrote to memory of 1344	2876	rundll32.exe	29
PID 2876 wrote to memory of 1344	2876	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.Data.Common.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.Data.Common.dll,#1
  2⤵
  PID:1344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads