60053fc2289d803a6b20728e2fccf49e179298aa55cf2c1c202d8715d685cc1c | Triage

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 14:53

Sharing

Report Analysis Logs

General

Target

nm2ytzbbjewqct.dll
Size

10KB
MD5

1ca0579358b764f49d199fd22a0f569f
SHA1

15377138e9a7a06ebeece6782edd3f3aa90ba917
SHA256

5520b6a010887b22921e66e0bc384ce320db3e48ae92e0a7654cb0354d23a57f
SHA512

9e0f71ebafd9b086ca65acaafedbdcc03ac8942d23df6e9d37244c739fbc0b964b33a2c666711cd1bde5cfa0f7778146227d5a89816de5718e381743aa36395e
SSDEEP

192:3zA+ViwUnzNFMXkqD5uXvUcdrIKq2pA98WrZjod0pS3Sy3:CankvUcOJwq8Wdjo2pYd

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3068	rundll32.exe
3068	rundll32.exe
3068	rundll32.exe
3068	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 3068	2388	rundll32.exe	29
PID 2388 wrote to memory of 3068	2388	rundll32.exe	29
PID 2388 wrote to memory of 3068	2388	rundll32.exe	29
PID 2388 wrote to memory of 3068	2388	rundll32.exe	29
PID 2388 wrote to memory of 3068	2388	rundll32.exe	29
PID 2388 wrote to memory of 3068	2388	rundll32.exe	29
PID 2388 wrote to memory of 3068	2388	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\nm2ytzbbjewqct.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\nm2ytzbbjewqct.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3068-0-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download