3c90b3d32f3fe37632edfad2b768cf77d70e7de0d3291d0e5274ea8a7dc69141 | Triage

Analysis

max time kernel
42s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/02/2023, 19:44

Sharing

Report Analysis Logs

General

Target

Slither x32y 64/nw_elf.dll
Size

114KB
MD5

9c18fed3911b120bc6cf07b698ac88fb
SHA1

4a836b85d3105a47aa5bdbe0de0d4732cbd0b774
SHA256

85d78b7f5ffb9d528c361824e2f25fa8e55ee8fbf2bf64140d925d91239fe109
SHA512

5eee334a58cccbb652da9f2459d0e7bc5703b8f9568d0c9a216f78fa86b2908e614ead82eb2b7cde179ca57a60f687624e47293660115079fdc89efbe978e5f4
SSDEEP

3072:RFujVYV9TDv7zdB6ENLkS7+183ijVoSHi:HujKbTDv1hNLkS7v6F

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1976	1980	rundll32.exe	28
PID 1980 wrote to memory of 1976	1980	rundll32.exe	28
PID 1980 wrote to memory of 1976	1980	rundll32.exe	28
PID 1980 wrote to memory of 1976	1980	rundll32.exe	28
PID 1980 wrote to memory of 1976	1980	rundll32.exe	28
PID 1980 wrote to memory of 1976	1980	rundll32.exe	28
PID 1980 wrote to memory of 1976	1980	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Slither x32y 64\nw_elf.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Slither x32y 64\nw_elf.dll",#1
  2⤵
  PID:1976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1976-55-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download