bf5cd1d4fec8401f45c2d9272a6e619bb93f2caabf23b4102a397c081e8308ae | Triage

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 17:08

Sharing

Report Analysis Logs

General

Target

eeaa5ba54a55fb6fa81e6fd9d14427a0N.dll
Size

3KB
MD5

eeaa5ba54a55fb6fa81e6fd9d14427a0
SHA1

8729d2f817a37664e34c285a2e6f7b350651ffab
SHA256

bf5cd1d4fec8401f45c2d9272a6e619bb93f2caabf23b4102a397c081e8308ae
SHA512

34307ae9f92bddac8c07ca42ee08a220ea9092c7ba152a3f02f8dc49b1141c7a99a3774a9d0dc6d78fd78d9b57560f78fc7f7bf6b6464ca15f9027c14faeec25

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2080	2232	rundll32.exe	30
PID 2232 wrote to memory of 2080	2232	rundll32.exe	30
PID 2232 wrote to memory of 2080	2232	rundll32.exe	30
PID 2232 wrote to memory of 2080	2232	rundll32.exe	30
PID 2232 wrote to memory of 2080	2232	rundll32.exe	30
PID 2232 wrote to memory of 2080	2232	rundll32.exe	30
PID 2232 wrote to memory of 2080	2232	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\eeaa5ba54a55fb6fa81e6fd9d14427a0N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\eeaa5ba54a55fb6fa81e6fd9d14427a0N.dll,#1
  2⤵
  PID:2080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads