4cfcc983609d06a8b6be4472247adb4651fe4749d1b620f0ef920b5b9775b7c0 | Triage

Analysis

max time kernel
38s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/02/2023, 17:30

Sharing

Report Analysis Logs

General

Target

gb.jpg.dll
Size

4KB
MD5

31a12ae662573380939a6df764d372e4
SHA1

54701819ad994c68a06afc5b020cf35e938a1914
SHA256

4cfcc983609d06a8b6be4472247adb4651fe4749d1b620f0ef920b5b9775b7c0
SHA512

3706f466d090c43c5c33dd9ddcec566671dbf79a8772b4113ce87035a8e82e4a45112920e67169e69f2d1459c7a39a4eb6e469a6ed0f31da6dee4bcf518ec3d1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 2008	1652	rundll32.exe	26
PID 1652 wrote to memory of 2008	1652	rundll32.exe	26
PID 1652 wrote to memory of 2008	1652	rundll32.exe	26
PID 1652 wrote to memory of 2008	1652	rundll32.exe	26
PID 1652 wrote to memory of 2008	1652	rundll32.exe	26
PID 1652 wrote to memory of 2008	1652	rundll32.exe	26
PID 1652 wrote to memory of 2008	1652	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gb.jpg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\gb.jpg.dll,#1
  2⤵
  PID:2008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2008-55-0x0000000075FC1000-0x0000000075FC3000-memory.dmp

Filesize
8KB

Download