a3e51f3f31af3d422450240974800b2701f54befdc20ecbd172de9b98cb75992 | Triage

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 09:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

prog.dll
Size

124KB
MD5

136b5814883dd68a926ba8368c666a81
SHA1

809b62e6d75ddad97e3240be1e071f944090ea14
SHA256

d113b104e0d1bc94cd0424bf30d5b4b150fe6b8139f200346448bde2b57670f5
SHA512

db0b370bf0a8b02efe6b93bc34a791ba37a894bec85a30c28380ff25430dc6bf372cb432aa6546138fa7263d63d5e53f864da7b9932d533d53bcbfa9f37d8fc9
SSDEEP

1536:yFEycQMTa0Ev5gYNIhLyNC1IbRSUxNm+y6nNdQglg4EgcnirhXd56cYixT9f/i:TyETCNIhmfa+vnNzDNRNxT9S

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 2708	2688	rundll32.exe	30
PID 2688 wrote to memory of 2708	2688	rundll32.exe	30
PID 2688 wrote to memory of 2708	2688	rundll32.exe	30
PID 2688 wrote to memory of 2708	2688	rundll32.exe	30
PID 2688 wrote to memory of 2708	2688	rundll32.exe	30
PID 2688 wrote to memory of 2708	2688	rundll32.exe	30
PID 2688 wrote to memory of 2708	2688	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\prog.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\prog.dll,#1
  2⤵
  PID:2708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads