ad93e037fa69cb66bd757866fd38ed0eab0db89541b4739c302aec7e797f5ec4 | Triage

Analysis

max time kernel
43s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
12-02-2023 16:50

Sharing

Report Analysis Logs

General

Target

32bit/TexToolWrap.dll
Size

562KB
MD5

b3779e78cf62c5bddac7be245da41a47
SHA1

16f26d3e6b5b9eb96c092e8ef307114226c20557
SHA256

4878322eebab8c5a7eaf906e3675419b25ae461b367dba280d0670e41494df5c
SHA512

ce50b72a397eab6cbe7768abdd4f696931aa669a6a41ef5ebaf669354219bcf84d175d57ed10655a431cc0a5833bccccf02a20dc27d19086f0dd84b8c473f20d
SSDEEP

12288:VwgpQur3Q8ENfiNlxlbc3/oeoz1dYMM8j1vM+Hn:KgpQur3Q8EN6Y3/oeaP9M8j1x

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 332 wrote to memory of 680	332	rundll32.exe	27
PID 332 wrote to memory of 680	332	rundll32.exe	27
PID 332 wrote to memory of 680	332	rundll32.exe	27
PID 332 wrote to memory of 680	332	rundll32.exe	27
PID 332 wrote to memory of 680	332	rundll32.exe	27
PID 332 wrote to memory of 680	332	rundll32.exe	27
PID 332 wrote to memory of 680	332	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\32bit\TexToolWrap.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:332
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\32bit\TexToolWrap.dll,#1
  2⤵
  PID:680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/680-54-0x0000000000000000-mapping.dmp

Download
memory/680-55-0x0000000075701000-0x0000000075703000-memory.dmp

Filesize
8KB

Download