12a97140043e32e3a4f15bb9a17e16692d06c33cd56bb6d497ac6be2c5c02093 | Triage

Analysis

max time kernel
24s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
15-02-2023 21:27

Sharing

Report Analysis Logs

General

Target

dll/DLL_AnalyzeGesturesInOne.dll
Size

61KB
MD5

06302fa1044ce5f410b4e50b45ee89d0
SHA1

cc6930123b6bf912f497d46f9e7916645422462a
SHA256

30ea045a8804aea07d4c10a1b65029459d45075033db71f91c5ddce9c35656f1
SHA512

105adebd3f237c0fd1d89fdd558fcf9093cd8f56bba31a64e68c32c4e94b3d65037ef690c5ce317cf192ceb688c68475a04ac744d9b1b6b94e8b194fed84d64e
SSDEEP

768:/M+87yTZDoZZlLQ2Gh+Ex252IcuEnbRwkW/GnTEDWqADvMMycB:/M+XSdQ2KLnFwAlD

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1144 wrote to memory of 1336	1144	rundll32.exe	rundll32.exe
PID 1144 wrote to memory of 1336	1144	rundll32.exe	rundll32.exe
PID 1144 wrote to memory of 1336	1144	rundll32.exe	rundll32.exe
PID 1144 wrote to memory of 1336	1144	rundll32.exe	rundll32.exe
PID 1144 wrote to memory of 1336	1144	rundll32.exe	rundll32.exe
PID 1144 wrote to memory of 1336	1144	rundll32.exe	rundll32.exe
PID 1144 wrote to memory of 1336	1144	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dll\DLL_AnalyzeGesturesInOne.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1144

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dll\DLL_AnalyzeGesturesInOne.dll,#1
2⤵
PID:1336

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1336-54-0x0000000000000000-mapping.dmp

Download
memory/1336-55-0x0000000075F01000-0x0000000075F03000-memory.dmp

Filesize
8KB

Download