596bc1168ba9c8e5e190b165a33d81fb7c9f729257c1b295d16bfce8b6276c85 | Triage

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 05:38

Sharing

Report Analysis Logs

General

Target

55faae75167bc8de181f452f18516a80N.dll
Size

3KB
MD5

55faae75167bc8de181f452f18516a80
SHA1

7001c5bacd8fc8985deddca141c521504658cc29
SHA256

596bc1168ba9c8e5e190b165a33d81fb7c9f729257c1b295d16bfce8b6276c85
SHA512

7ea9c3b2f88d954acf7e0beeba48138bf21c816a1a7d15dbd816947662112168bc24e28e9be09e5452e81aaaab99b66ab991f2a47ee273cff32ee269ff53c0bf

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 2708	2632	rundll32.exe	30
PID 2632 wrote to memory of 2708	2632	rundll32.exe	30
PID 2632 wrote to memory of 2708	2632	rundll32.exe	30
PID 2632 wrote to memory of 2708	2632	rundll32.exe	30
PID 2632 wrote to memory of 2708	2632	rundll32.exe	30
PID 2632 wrote to memory of 2708	2632	rundll32.exe	30
PID 2632 wrote to memory of 2708	2632	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\55faae75167bc8de181f452f18516a80N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\55faae75167bc8de181f452f18516a80N.dll,#1
  2⤵
  PID:2708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads