9d4c53d79f1dd1a47ef951ae6e54b0e0b87218e2a0b17532c7181a6c505b0dd2 | Triage

Analysis

max time kernel
15s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 22:47

Sharing

Report Analysis Logs

General

Target

36186e57726e2bd202dee4f86b31e400N.dll
Size

5KB
MD5

36186e57726e2bd202dee4f86b31e400
SHA1

03432669c3d4872778fdae9f2f38a4c43727b258
SHA256

9d4c53d79f1dd1a47ef951ae6e54b0e0b87218e2a0b17532c7181a6c505b0dd2
SHA512

6226aed34ff6e899d2dbf8acfbe81bb9edc52f82199d9c8b40f890f0d4a1e8d317321aebe2f093ac1c35f4d7f10deebbe19342955f5a3f99d125f1cddb8ec0f1
SSDEEP

96:DixZjmjtjd8jPjcZGR5TIoT/4De9vyrLFhSxdXSD+Ah+sL:unSR6bgYBR90FIxmM

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2204	2976	rundll32.exe	30
PID 2976 wrote to memory of 2204	2976	rundll32.exe	30
PID 2976 wrote to memory of 2204	2976	rundll32.exe	30
PID 2976 wrote to memory of 2204	2976	rundll32.exe	30
PID 2976 wrote to memory of 2204	2976	rundll32.exe	30
PID 2976 wrote to memory of 2204	2976	rundll32.exe	30
PID 2976 wrote to memory of 2204	2976	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\36186e57726e2bd202dee4f86b31e400N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\36186e57726e2bd202dee4f86b31e400N.dll,#1
  2⤵
  PID:2204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads