0ff0d7f6a67bb2daa879f111d4649231cb3bd89090085a06c9039aabc5fecb2a | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 09:05

Sharing

Report Analysis Logs

General

Target

CLibrary.dll
Size

6.5MB
MD5

9a319ba89b9427cd2251fe2b5b2f8268
SHA1

ca95629d35f35d703acde97a9219955d24fb9dc2
SHA256

50b11d03d16c1d71072647d3a41dd4370ee356306984f467c274260f5ef13958
SHA512

af7affbedd59dad1509d820b602777d4e56fa5636112f976f843e83e98c52c8c8f7b37d6c7622483ba7113cb4de92754e72102aff25a5852e0596f171039b37c
SSDEEP

98304:v9wyQ37ksSqslMh/xM/uZzVrwQYpKPJDeg3lPq6hTa1DMn:Vh+XKC/xFhVrwQrPJ9iY

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

3 2288 rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2364 wrote to memory of 2288	2364	rundll32.exe	rundll32.exe
PID 2364 wrote to memory of 2288	2364	rundll32.exe	rundll32.exe
PID 2364 wrote to memory of 2288	2364	rundll32.exe	rundll32.exe
PID 2364 wrote to memory of 2288	2364	rundll32.exe	rundll32.exe
PID 2364 wrote to memory of 2288	2364	rundll32.exe	rundll32.exe
PID 2364 wrote to memory of 2288	2364	rundll32.exe	rundll32.exe
PID 2364 wrote to memory of 2288	2364	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CLibrary.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2364

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CLibrary.dll,#1
2⤵
- Blocklisted process makes network request
PID:2288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...