bef12d75ed3da68825239fd5b56783ecf9b1e1250be7f169db445af6afa6cced | Triage

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a34246d6d5f02634b38ab6c76033dbb0N.dll
Size

7KB
MD5

a34246d6d5f02634b38ab6c76033dbb0
SHA1

7a719135a5cacbe648eeed08946ea0fde53b0572
SHA256

bef12d75ed3da68825239fd5b56783ecf9b1e1250be7f169db445af6afa6cced
SHA512

9c885390f4a0e3074e25793f12206a366e3157c223a16efbfdf2fa2f3660c06af4cf25afe297f4d3785cf952b97972955664fbe7c1311dba9b4a759fa48c582b
SSDEEP

96:VGEETrMLH5HLD1faHCE1Msa/fJ58Mob7eCv+UE4Xw:efM5LDAva/hxS+Liw

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 3000	1484	rundll32.exe	30
PID 1484 wrote to memory of 3000	1484	rundll32.exe	30
PID 1484 wrote to memory of 3000	1484	rundll32.exe	30
PID 1484 wrote to memory of 3000	1484	rundll32.exe	30
PID 1484 wrote to memory of 3000	1484	rundll32.exe	30
PID 1484 wrote to memory of 3000	1484	rundll32.exe	30
PID 1484 wrote to memory of 3000	1484	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a34246d6d5f02634b38ab6c76033dbb0N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a34246d6d5f02634b38ab6c76033dbb0N.dll,#1
  2⤵
  PID:3000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads