9fccbbeea4b966efae9ff729b9aa7670df52aea2c2eea49adb7459c875c7166f | Triage

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 01:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

AddinTradeBox.dll
Size

1.4MB
MD5

cfb235868c814c429c69cedcfa136a18
SHA1

98b663f91d3dd3df1688c5b7e04d5891116b8d68
SHA256

5aef43404ec1e80c02c4b1ef69762b9e21a73e26911356823f102f5a71a50302
SHA512

f0e46c0175c400dee186bb9027c33adf5e0607ddcbf33fa6689694689cbeda3a53d9f13ca31455b643f885e705a45fd54141deff5ab3d7531636a207f15ab40b
SSDEEP

24576:HmYhAKVd1oAeS99p3MQDLw/iMambwUpKoN:GH208iEQdN

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 1736	1340	rundll32.exe	28
PID 1340 wrote to memory of 1736	1340	rundll32.exe	28
PID 1340 wrote to memory of 1736	1340	rundll32.exe	28
PID 1340 wrote to memory of 1736	1340	rundll32.exe	28
PID 1340 wrote to memory of 1736	1340	rundll32.exe	28
PID 1340 wrote to memory of 1736	1340	rundll32.exe	28
PID 1340 wrote to memory of 1736	1340	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AddinTradeBox.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\AddinTradeBox.dll,#1
  2⤵
  PID:1736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1736-55-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download