2a469601228e95defe50092a2dde56bd0a6ea62ff8162653094c9d41f7ab95a4 | Triage

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 08:06

Sharing

Report Analysis Logs

General

Target

sol3nia.dll
Size

355KB
MD5

88789ba7f00909005b2fe18ce83dbf58
SHA1

08ffb813d1d7544380aa1b0e41703207451e1def
SHA256

00dcc4642d488643856259cd3c576d9e24045b48783fc21ebdccd5fb4de66f8c
SHA512

c78f79bd27a535e2efc1a133bfe92048dc3a77e9b9e6ef0aebab6403835fb585771c4da14493a1bf81a72e0f8340a5db81964e8852b4a3e8d0f9232985cd3478
SSDEEP

6144:vi6CAPF0IVqcbMQmJU+GkJXzgNLyKTknXKVp5/yQLGG/z2mpS8PUzdJd:HCEqcbMQCU+n9zgNOKTRp59jimY8PW

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 860	2064	rundll32.exe	30
PID 2064 wrote to memory of 860	2064	rundll32.exe	30
PID 2064 wrote to memory of 860	2064	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sol3nia.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2064 -s 92
  2⤵
  PID:860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads