72408c47b476a4e0faf6c9aa56f0af8307c82060fff1b4fe2076ad53706040c0 | Triage

Analysis

max time kernel
25s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 09:12

Sharing

Report Analysis Logs

General

Target

9ac0b3e0ea2b3d77d1dc4c10cd2c82e0N.dll
Size

6KB
MD5

9ac0b3e0ea2b3d77d1dc4c10cd2c82e0
SHA1

bdaa5f8616bb8c540d33c92c115297077b2039aa
SHA256

72408c47b476a4e0faf6c9aa56f0af8307c82060fff1b4fe2076ad53706040c0
SHA512

02d5ecf27a847705f448733271f9d64a8652e62f70229e2ac148db61b61159f3cc56f8b9f3a1168dfd91c786db528348fb833f75181a560ae32e7c73c712ee14
SSDEEP

96:hy859x0P8MavRbUSkkO91/NFwSljleuiRAneFTNGrNU:F5oLER4SvO91/Z3xwk

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 2812	2840	rundll32.exe	30
PID 2840 wrote to memory of 2812	2840	rundll32.exe	30
PID 2840 wrote to memory of 2812	2840	rundll32.exe	30
PID 2840 wrote to memory of 2812	2840	rundll32.exe	30
PID 2840 wrote to memory of 2812	2840	rundll32.exe	30
PID 2840 wrote to memory of 2812	2840	rundll32.exe	30
PID 2840 wrote to memory of 2812	2840	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ac0b3e0ea2b3d77d1dc4c10cd2c82e0N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ac0b3e0ea2b3d77d1dc4c10cd2c82e0N.dll,#1
  2⤵
  PID:2812

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads