1516dac7d779374b47a26b86b190a5bb4e78ae264438de76572f6b94d4ad8eaf | Triage

Analysis

max time kernel
26s
max time network
17s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 00:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3e3cc7c79aa81176588890b36d8a2f30N.dll
Size

6KB
MD5

3e3cc7c79aa81176588890b36d8a2f30
SHA1

9627f7d47df4bf06f235eff317d85719e702cac5
SHA256

1516dac7d779374b47a26b86b190a5bb4e78ae264438de76572f6b94d4ad8eaf
SHA512

f759e3ec6fac18fe74522fd2eae4e3d7f57003ec457fc49ef431a55fe1bade9cd7d7f58ab8a8304d8a4791c97aa3b59cff6726a64af947c4cef76775f561c747
SSDEEP

48:6WQV5YVOqtV0H1pw9ygYVUG0xB+BDq9J5SC:8qtV0HAr4QB+FqX5SC

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2976	2876	rundll32.exe	30
PID 2876 wrote to memory of 2976	2876	rundll32.exe	30
PID 2876 wrote to memory of 2976	2876	rundll32.exe	30
PID 2876 wrote to memory of 2976	2876	rundll32.exe	30
PID 2876 wrote to memory of 2976	2876	rundll32.exe	30
PID 2876 wrote to memory of 2976	2876	rundll32.exe	30
PID 2876 wrote to memory of 2976	2876	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e3cc7c79aa81176588890b36d8a2f30N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e3cc7c79aa81176588890b36d8a2f30N.dll,#1
  2⤵
  PID:2976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads