18f7857e3bb5f9f830917c9073d3c339bf7b3e14fcd3edfdca976287f41536c6 | Triage

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 19:10

Sharing

Report Analysis Logs

General

Target

m32/pthreadGC2.dll
Size

92KB
MD5

ac05fbba61f939cd90133032f2595c69
SHA1

ce3d3811457176dbefb06f5a395505eef8b2a641
SHA256

c271f42da9f1483de15869914d216a8ef44ca80c0d5907789b6e9873e3aa245f
SHA512

86992775393bf03a13058246c780cb20ea505f6bfdc3baec57574bae076369ef0d2c154bb14fcac947e96e11a93baa3d88b4b49d3fdedd2da2a5c36caab85288
SSDEEP

1536:oeHa2+yL/iA1P91IBfiH/p/DKIMds0RweKZw:oe6oLiA1rIBfiH/p/DKIMds0Rwel

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1920 wrote to memory of 1976	1920	rundll32.exe	rundll32.exe
PID 1920 wrote to memory of 1976	1920	rundll32.exe	rundll32.exe
PID 1920 wrote to memory of 1976	1920	rundll32.exe	rundll32.exe
PID 1920 wrote to memory of 1976	1920	rundll32.exe	rundll32.exe
PID 1920 wrote to memory of 1976	1920	rundll32.exe	rundll32.exe
PID 1920 wrote to memory of 1976	1920	rundll32.exe	rundll32.exe
PID 1920 wrote to memory of 1976	1920	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\m32\pthreadGC2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1920

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\m32\pthreadGC2.dll,#1
2⤵
PID:1976

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1976-54-0x0000000000000000-mapping.dmp

Download
memory/1976-55-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download