d57e687edc4c24fdadbf7c07c5e6369efeb3dbb8757132d2a92752739c6dfbe4 | Triage

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 14:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

04e0879f2375dad1e008c2f7fb0873e0N.dll
Size

156KB
MD5

04e0879f2375dad1e008c2f7fb0873e0
SHA1

8cc5d78111a196e57064bdb0fee964c48f5b98ce
SHA256

d57e687edc4c24fdadbf7c07c5e6369efeb3dbb8757132d2a92752739c6dfbe4
SHA512

f1a15ad20403b5835437f1f9ce266872a3e1d85170409ba424a1d60909aeae3d506ddba5bc073b26e4277e4b611c27247a675ab2929fc68713efd8989231b072
SSDEEP

3072:TIqkRbS0sUfN9qYCmo9KihpVbuIiXBJ+fcSP6qYq:Ydr/ihpVW+x6qY

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1864	1640	rundll32.exe	30
PID 1640 wrote to memory of 1864	1640	rundll32.exe	30
PID 1640 wrote to memory of 1864	1640	rundll32.exe	30
PID 1640 wrote to memory of 1864	1640	rundll32.exe	30
PID 1640 wrote to memory of 1864	1640	rundll32.exe	30
PID 1640 wrote to memory of 1864	1640	rundll32.exe	30
PID 1640 wrote to memory of 1864	1640	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\04e0879f2375dad1e008c2f7fb0873e0N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\04e0879f2375dad1e008c2f7fb0873e0N.dll,#1
  2⤵
  PID:1864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1864-0-0x00000000746B5000-0x00000000746D7000-memory.dmp

Filesize
136KB

Download