e85ade355beeae9796b8d0b760ba78e82d8436f210e1302b053baa8d206d98a6 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 06:00

Sharing

Report Analysis Logs

General

Target

5736b62b611b7bf8d00f61e8042732e0N.dll
Size

3KB
MD5

5736b62b611b7bf8d00f61e8042732e0
SHA1

c2425412aa2fce58412189eef3ade81dda289404
SHA256

e85ade355beeae9796b8d0b760ba78e82d8436f210e1302b053baa8d206d98a6
SHA512

a3750a1b5f1b7f2423d7374b14d8592a4babf284773917c1f6055e4e27f8083e87815cd970edb1b2cac0a200cb1471cdb475ac6edf7f5b858a1549a6aba93cc0

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 1072	2564	rundll32.exe	31
PID 2564 wrote to memory of 1072	2564	rundll32.exe	31
PID 2564 wrote to memory of 1072	2564	rundll32.exe	31
PID 2564 wrote to memory of 1072	2564	rundll32.exe	31
PID 2564 wrote to memory of 1072	2564	rundll32.exe	31
PID 2564 wrote to memory of 1072	2564	rundll32.exe	31
PID 2564 wrote to memory of 1072	2564	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5736b62b611b7bf8d00f61e8042732e0N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5736b62b611b7bf8d00f61e8042732e0N.dll,#1
  2⤵
  PID:1072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads