ad93e037fa69cb66bd757866fd38ed0eab0db89541b4739c302aec7e797f5ec4 | Triage

Analysis

max time kernel
30s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12/02/2023, 16:50

Sharing

Report Analysis Logs

General

Target

32bit/Plugins/TerrainData.dll
Size

32KB
MD5

cc5403ea37d200db10c8690cead032a7
SHA1

137546870f8a5fe3a37a16916645713d6bc9fa22
SHA256

9b8f8b75fae3db2268bf7406c3b4b8b3c0c78db6a72b57e7fee1a4059b34e157
SHA512

11a06a0891298befee091138e67c36897b045ccd8888b1737032870e823668038b8c05b619780b16f8599d16030d61644a15a803371ecc656a1e8d49dd69bfa2
SSDEEP

768:026eGQ3HhnoBAZjyMNJympe8zQwOZordSne:026i3HhoBAZjyInDOZ5ne

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 1472	1536	rundll32.exe	26
PID 1536 wrote to memory of 1472	1536	rundll32.exe	26
PID 1536 wrote to memory of 1472	1536	rundll32.exe	26
PID 1536 wrote to memory of 1472	1536	rundll32.exe	26
PID 1536 wrote to memory of 1472	1536	rundll32.exe	26
PID 1536 wrote to memory of 1472	1536	rundll32.exe	26
PID 1536 wrote to memory of 1472	1536	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\32bit\Plugins\TerrainData.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\32bit\Plugins\TerrainData.dll,#1
  2⤵
  PID:1472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1472-55-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download