91a8d66f5c1f651e0f60c456fa8dd06347f69be8ba5542f9c6781e6714962fa9 | Triage

Analysis

max time kernel
10s
max time network
17s
platform
windows7_x64
resource
win7v20210408
submitted
30-07-2021 09:06

Sharing

Report Analysis Logs

General

Target

GGLanguage.dll
Size

148KB
MD5

48cfefdcd1b9f0246e47e224491c75dc
SHA1

2d34d41bcca5757849b752b4845462fcb7ca1b3d
SHA256

089e472bccecf674ed5a08fff38d86be4b74ef7a64ef7aa0dbd2d4e3e83e25fe
SHA512

61b24536f4f37f4320d5167a984bb18f2c47c493a76dcd8a7602f64c12c1c9df5ffae26f8bed59c4e1034d17efc6de2d57d3357b5015327299b57640dac09957

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1840 wrote to memory of 2044	1840	rundll32.exe	rundll32.exe
PID 1840 wrote to memory of 2044	1840	rundll32.exe	rundll32.exe
PID 1840 wrote to memory of 2044	1840	rundll32.exe	rundll32.exe
PID 1840 wrote to memory of 2044	1840	rundll32.exe	rundll32.exe
PID 1840 wrote to memory of 2044	1840	rundll32.exe	rundll32.exe
PID 1840 wrote to memory of 2044	1840	rundll32.exe	rundll32.exe
PID 1840 wrote to memory of 2044	1840	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GGLanguage.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1840

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GGLanguage.dll,#1
2⤵
PID:2044

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2044-60-0x0000000000000000-mapping.dmp

Download
memory/2044-61-0x00000000757C1000-0x00000000757C3000-memory.dmp

Filesize
8KB

Download