ff40a88739c47c64fc1445223d8d79f5ad1e656a86d795fa9908cd1b0b17a06c | Triage

Analysis

max time kernel
11s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 18:50

Sharing

Report Analysis Logs

General

Target

fe055f8c9a737605f2c4d8624d2b3810N.dll
Size

6KB
MD5

fe055f8c9a737605f2c4d8624d2b3810
SHA1

8bd1f68e4c09bd9ad8c7d9d4af62b3532ba030af
SHA256

ff40a88739c47c64fc1445223d8d79f5ad1e656a86d795fa9908cd1b0b17a06c
SHA512

12f407cc0d0cf5fa2f527c34b424e099fae984ff62e592304c68f70dee5f953f8dd4d99053e5b75c85abfcd22e42e0d9ae3939572fe8f303e1c326ad08b3ac24
SSDEEP

96:hy859x0P8MaqMoKmFS4NYNMX+SDfb6laAyhfjVJqVn7GC:F5oLGPmFS4NYu1fLzhm

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 676	2520	rundll32.exe	30
PID 2520 wrote to memory of 676	2520	rundll32.exe	30
PID 2520 wrote to memory of 676	2520	rundll32.exe	30
PID 2520 wrote to memory of 676	2520	rundll32.exe	30
PID 2520 wrote to memory of 676	2520	rundll32.exe	30
PID 2520 wrote to memory of 676	2520	rundll32.exe	30
PID 2520 wrote to memory of 676	2520	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe055f8c9a737605f2c4d8624d2b3810N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe055f8c9a737605f2c4d8624d2b3810N.dll,#1
  2⤵
  PID:676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads