ccbcde2e129c52025b7682182a8587311f50e0bfbad19c4bf7e434769414620b | Triage

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 16:57

Sharing

Report Analysis Logs

General

Target

boardsailing.dll
Size

269KB
MD5

c764812746c3803750c85f670ceb7296
SHA1

cbb8852f9743a6b2698e56d0099e07e8d56dfa21
SHA256

e31ce5e572f9bf121326d8e4ea93c288f009a11dd5d75c043d5648f5ca7d001c
SHA512

34fb5b19c8df385164846cecb08921b84df329443d5e7ab441635a7e449a9a19f466ab432c76e69972a95ee0e43fd4315366db3a6feb4e350f3d0367499b45e1
SSDEEP

6144:dTHJ5BU2WigC+/NZy40onB114x2N8IcuzE7LZ:5DB0igC+/NHB11S2i7d

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1204	1280	WerFault.exe	15

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1280	rundll32.exe
1280	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 1204	1280	rundll32.exe	27
PID 1280 wrote to memory of 1204	1280	rundll32.exe	27
PID 1280 wrote to memory of 1204	1280	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\boardsailing.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1280 -s 152
  2⤵
  - Program crash
  PID:1204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads