b5776d41fa01459dd86c95b701942e5c85a0293b5f86df4e8c5785f0dd4fa77b | Triage

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 02:49

Sharing

Report Analysis Logs

General

Target

68db6aa2b3aef167649b47a58e5d94c0N.dll
Size

6KB
MD5

68db6aa2b3aef167649b47a58e5d94c0
SHA1

d1564da9908fe83470aeb44429ea7c4ab83951df
SHA256

b5776d41fa01459dd86c95b701942e5c85a0293b5f86df4e8c5785f0dd4fa77b
SHA512

f0f1e42203fbab2686053f29ddff7388806b2532e561321e3aee3f8d8594b8ea04bd7e4885b71efeb09120b431910b7618c836673a5879f4ffaa69f8dfc7e111
SSDEEP

96:VGEETrMLH5jXKY/T6XodKuteMIj7Kyp+Qx9EQow:efMEY/WXoLdIfKzQx6Q

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 1676	1924	rundll32.exe	28
PID 1924 wrote to memory of 1676	1924	rundll32.exe	28
PID 1924 wrote to memory of 1676	1924	rundll32.exe	28
PID 1924 wrote to memory of 1676	1924	rundll32.exe	28
PID 1924 wrote to memory of 1676	1924	rundll32.exe	28
PID 1924 wrote to memory of 1676	1924	rundll32.exe	28
PID 1924 wrote to memory of 1676	1924	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\68db6aa2b3aef167649b47a58e5d94c0N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\68db6aa2b3aef167649b47a58e5d94c0N.dll,#1
  2⤵
  PID:1676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads