48a97f6aee23543909fc1b7341dff8aa0f1caba229d61d3b0de4e03df02b1ac0 | Triage

Analysis

max time kernel
14s
max time network
18s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
21/11/2024, 08:53

Sharing

Report Analysis Logs

General

Target

1234.dll
Size

18KB
MD5

12d949569325814e0405d5475f2162bf
SHA1

65463784d384199cf463cc678a44563c1141bc36
SHA256

48a97f6aee23543909fc1b7341dff8aa0f1caba229d61d3b0de4e03df02b1ac0
SHA512

65435189d7896153d3195bf23e86697a41a275f88ab45347c21eb7ebc0e24b4b94d79b0b034ec327ef79a5832abee8ab3ffe19218c56b7bb971326a7da0c365d
SSDEEP

384:HsVt564yp6QmAgyEeTaYwCf1r9H91OAHnx:gnDZyEeuYVf59LOQx

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 796	2052	rundll32.exe	29
PID 2052 wrote to memory of 796	2052	rundll32.exe	29
PID 2052 wrote to memory of 796	2052	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1234.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2052 -s 84
  2⤵
  PID:796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads