f8ae0a8e7770dd0e3e68cf99b2d9e5d7152a39ca788e2ddfcf93b2118e4649c4 | Triage

Analysis

max time kernel
82s
max time network
88s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 18:20

Sharing

Report Analysis Logs

General

Target

FastVerCode.dll
Size

84KB
MD5

4ef099b36c081359c032182555f545a6
SHA1

f6169d4ddac782a092b43f304e188788986cbc9a
SHA256

7041867ea7411edd838530d9ff7552d47022bac64d5fdafcb243d703eae4b9e7
SHA512

2bea41476ee531ff01af7b5eb858d5eaadaf99dd4545157550898af3b85a70165d3877c7bbe170bf702646286b6c72adeabd629b9206a0b04c3753a5b489dbaf
SSDEEP

1536:Pz2MDZizaHLDykP+LOdtPnmdGd2Kt7wAqoBUAJ:b2MYOHKkGLOdFmNdAqgUAJ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1896 wrote to memory of 2044	1896	rundll32.exe	rundll32.exe
PID 1896 wrote to memory of 2044	1896	rundll32.exe	rundll32.exe
PID 1896 wrote to memory of 2044	1896	rundll32.exe	rundll32.exe
PID 1896 wrote to memory of 2044	1896	rundll32.exe	rundll32.exe
PID 1896 wrote to memory of 2044	1896	rundll32.exe	rundll32.exe
PID 1896 wrote to memory of 2044	1896	rundll32.exe	rundll32.exe
PID 1896 wrote to memory of 2044	1896	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FastVerCode.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1896

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FastVerCode.dll,#1
2⤵
PID:2044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2044-54-0x0000000000000000-mapping.dmp

Download
memory/2044-55-0x0000000076871000-0x0000000076873000-memory.dmp

Filesize
8KB

Download