818a13cb734fe2db6b0e47c6f1d067a5dee5690a4423b12307866e5642206bd0 | Triage

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 20:02

Sharing

Report Analysis Logs

General

Target

005d15ae663e71cc46d631210eb4c360N.dll
Size

6KB
MD5

005d15ae663e71cc46d631210eb4c360
SHA1

de40a7014ee12cce8e60d1a73e74fc093faf0185
SHA256

818a13cb734fe2db6b0e47c6f1d067a5dee5690a4423b12307866e5642206bd0
SHA512

6efda5d06d2ff5be4457ca52c81f324d93448dcd611d216a09f134738b91ba9854a036bfa486ec314129ea5d4abe02cd1f5f2e6485729f41aed1e88c2a6f2846
SSDEEP

96:hy859x0P8Ma0nzcE13RGCdlzyrtJ0IlOmnGiwjztF4m:F5oLnQehGCvQ/0IKxzw

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 2360	2608	rundll32.exe	30
PID 2608 wrote to memory of 2360	2608	rundll32.exe	30
PID 2608 wrote to memory of 2360	2608	rundll32.exe	30
PID 2608 wrote to memory of 2360	2608	rundll32.exe	30
PID 2608 wrote to memory of 2360	2608	rundll32.exe	30
PID 2608 wrote to memory of 2360	2608	rundll32.exe	30
PID 2608 wrote to memory of 2360	2608	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\005d15ae663e71cc46d631210eb4c360N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\005d15ae663e71cc46d631210eb4c360N.dll,#1
  2⤵
  PID:2360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads