2a2a5ea21354c59363829f115a6e6cf0d263503cb6f76a8cff0b5309c3cde00f | Triage

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 23:21

Sharing

Report Analysis Logs

General

Target

29e056b73581a25a851010a220152380N.dll
Size

7.4MB
MD5

29e056b73581a25a851010a220152380
SHA1

360e19b100ea66883e75e01cb1aa575a58da2eac
SHA256

2a2a5ea21354c59363829f115a6e6cf0d263503cb6f76a8cff0b5309c3cde00f
SHA512

762177db3cef9749d2810116910613bbd276994f51c1743a50cb573033f8a1eaee84df75d25604cb475857719d7ac11c4dfa70bdb31959475c9361f1917b47dd
SSDEEP

196608:BQZ2//NQiNDFkCJ898Eu668hz8NwyNX2wu+iK:uZ2//ND0CyqsoNwsXv

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 2824	2788	rundll32.exe	31
PID 2788 wrote to memory of 2824	2788	rundll32.exe	31
PID 2788 wrote to memory of 2824	2788	rundll32.exe	31
PID 2788 wrote to memory of 2824	2788	rundll32.exe	31
PID 2788 wrote to memory of 2824	2788	rundll32.exe	31
PID 2788 wrote to memory of 2824	2788	rundll32.exe	31
PID 2788 wrote to memory of 2824	2788	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\29e056b73581a25a851010a220152380N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\29e056b73581a25a851010a220152380N.dll,#1
  2⤵
  PID:2824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads