f034640560565580e9233100f97d3e6a594915bd7d900cff444fd1c2c48c2cc0 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 17:03

Sharing

Report Analysis Logs

General

Target

$TEMP/getmacaddress.dll
Size

156KB
MD5

860e633786ad08a8013327052695d669
SHA1

67eb0e35b86e677b99ff5947e28c8b55a9d81690
SHA256

d6017709adc7f6bed36c3ad932d5e68c699418c9baade81dca0c145d4661cc46
SHA512

2acde6cccab29aab16d0b6235351b0239eda19ae568553bdb8f80c8fc49ece72deafd1237e08f14c1d4ea3facbade97db8c442ecb500d7d5928a7e920fd3f85a
SSDEEP

3072:DLLYx20PcAAtmt0O7GcezOIUiTdrqBWnBfFw5bPlRp:Dn0phV7d+dT3BQtL

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2252	2360	rundll32.exe	31
PID 2360 wrote to memory of 2252	2360	rundll32.exe	31
PID 2360 wrote to memory of 2252	2360	rundll32.exe	31
PID 2360 wrote to memory of 2252	2360	rundll32.exe	31
PID 2360 wrote to memory of 2252	2360	rundll32.exe	31
PID 2360 wrote to memory of 2252	2360	rundll32.exe	31
PID 2360 wrote to memory of 2252	2360	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\getmacaddress.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\getmacaddress.dll,#1
  2⤵
  PID:2252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads