125f296c4f5617819ff56818e3b6c6e2cc463a994e7061a8a5fc58dd189ea3e3 | Triage

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20-07-2024 01:40

Sharing

Report Analysis Logs

General

Target

dialogs.dll
Size

150KB
MD5

45c6e0a1949c5c4feecfa8c66fdab2a6
SHA1

50d286260a53b616168c85553e2b27a0b061afca
SHA256

2f7eac54a270466b035590faa774e6c6450f81645d5d5688227e75230f8b7b7a
SHA512

1dc516a3879bef83f76cd2f88bf0d1cb93685a890e5937b74b8de9d1d0a5abcef7834e69d9759e744183c23fd0dd7cd63b1b96363b39c5a3c36caa993eefc75d
SSDEEP

1536:L9DPZUtR0JUtRe0CWI1q6bbxcg3Xk1REv4bsBl+q:pDRUtR0JUtRevbqyxckqEvusBl+q

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2532	2412	rundll32.exe	30
PID 2412 wrote to memory of 2532	2412	rundll32.exe	30
PID 2412 wrote to memory of 2532	2412	rundll32.exe	30
PID 2412 wrote to memory of 2532	2412	rundll32.exe	30
PID 2412 wrote to memory of 2532	2412	rundll32.exe	30
PID 2412 wrote to memory of 2532	2412	rundll32.exe	30
PID 2412 wrote to memory of 2532	2412	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dialogs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dialogs.dll,#1
  2⤵
  PID:2532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads