Analysis

  • max time kernel
    13s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    13-01-2025 05:49

General

  • Target

    c0a3a78dc3cb60b0aca900c65d39317142afecf2e4d9f27fe6870a37a0b8757f.dll

  • Size

    327KB

  • MD5

    5645a6c7a96b60f4c46f132e87974783

  • SHA1

    0756c54ff1057dcadb34373d72f68f36131fe9f8

  • SHA256

    c0a3a78dc3cb60b0aca900c65d39317142afecf2e4d9f27fe6870a37a0b8757f

  • SHA512

    ab97432503e786c20d1ef9c74b4346e9b28bd243d594bcce2c9d9b7efd34507b57d89072b795439d42cb54d5487385d3c7dfca1cc564974370cdf2d66bf9d981

  • SSDEEP

    6144:EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC48Ss9Ei:EmWhND9yJz+b1FcMLmp2AT8Ssd

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0a3a78dc3cb60b0aca900c65d39317142afecf2e4d9f27fe6870a37a0b8757f.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2808
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0a3a78dc3cb60b0aca900c65d39317142afecf2e4d9f27fe6870a37a0b8757f.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2216

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.