1c388a8bd8a2f14fb270c3bcd6ef475f7536f1dd6412f0e91746c054d15db58d | Triage

Analysis

max time kernel
4s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 21:55

Sharing

Report Analysis Logs

General

Target

Ծע/ethreadnew.dll
Size

48KB
MD5

b63c5fe0ecc37dc8875e6f5a005eaf0b
SHA1

1611a5105b3f0d86ee633e1deb1beb85d451e4ca
SHA256

4c48c0c3941b1851e69773170dafa56099a8d8c1d55164d465dc50867a62a258
SHA512

7bba7504fde51bc2e34b7676bd313d2e9486f1f1f5b48b4ad7fb4a84109d7dd1f6938b1b107cb7f058287c44254cb0c52291f4de81caa1ef378d8f9433a5d4e4
SSDEEP

768:adPnk2MB8FjWl9uTSyVmKRGK6TmPsLX3fwURhFvljyX9:adZMB8FjYuTrVtq7XPnRPl

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 1256	772	rundll32.exe	28
PID 772 wrote to memory of 1256	772	rundll32.exe	28
PID 772 wrote to memory of 1256	772	rundll32.exe	28
PID 772 wrote to memory of 1256	772	rundll32.exe	28
PID 772 wrote to memory of 1256	772	rundll32.exe	28
PID 772 wrote to memory of 1256	772	rundll32.exe	28
PID 772 wrote to memory of 1256	772	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Ծע\ethreadnew.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Ծע\ethreadnew.dll,#1
  2⤵
  PID:1256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1256-55-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download