4c341e0ecead6406ddb022a7d61f275977aa7638867db55e3e3679330fba5250 | Triage

Resubmissions

06/02/2025, 12:59

250206-p8ae9svqaz 10

06/02/2025, 01:41

250206-b4azcayna1 10

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/02/2025, 01:41

Sharing

Report Analysis Logs

General

Target

123.dll
Size

2.3MB
MD5

a31a76eee94650e333ae59b7f74d394e
SHA1

1696e8b10ae4d91730cdd386f6deb2115b170416
SHA256

4c341e0ecead6406ddb022a7d61f275977aa7638867db55e3e3679330fba5250
SHA512

26190a4c3079fed6695d89ba5dcfeab590da029952e1fdddcd8ad20b4ef8a3fe1cda748afe340eb8b6c95697532b4107f9b87760727c70465c5973023e85ecdf
SSDEEP

49152:mte5uI3Oe4DiBqcWeyh7p4JumqBq7CdJywzqPGmTLBxy:m53YumB7Ch1mnBY

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2708	2332	rundll32.exe	30
PID 2332 wrote to memory of 2708	2332	rundll32.exe	30
PID 2332 wrote to memory of 2708	2332	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\123.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2332 -s 156
  2⤵
  PID:2708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads