e498b7a3b8c47519121d0f94bca46d9d4f4611a348377a1070cad78745e4f1b2 | Triage

Analysis

max time kernel
0s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-10-2022 07:52

Sharing

Report Analysis Logs

General

Target

cracked dll/amtlib.dll
Size

1.7MB
MD5

69a95e60a3231cf5ff6715a32e98aa17
SHA1

95998a498a8aa91c4cf7ccb23fc5cfec526e82fd
SHA256

e560e1b25778fa669d8d4960e2a6a847cd0a4aa5d1042527f1a4998891b37d5f
SHA512

a248b203bacb0c4ecaab2ad8961103b5115c6195e62000e6ec1a531d142c2a58cd8135d5789442b37634e51cfd15734f2049372ebfe870ad9575da2a792dcec6
SSDEEP

49152:pCWDqQIXuvGZsenvmuhrj/oOqja4LT3Ibdycl7xtGsu7W:EZsevmuZQOqm4gTl7xtP

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 900 wrote to memory of 780	900	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 780	900	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 780	900	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 780	900	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 780	900	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 780	900	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 780	900	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\cracked dll\amtlib.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:900

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\cracked dll\amtlib.dll",#1
2⤵
PID:780

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/780-54-0x0000000000000000-mapping.dmp

Download
memory/780-55-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download