d9d8306339ad71f6e941cdc5426ab5fefdfcfcb3cee8e54780e703d6c1e1ac77 | Triage

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20230220-es
resource tags

arch:x64arch:x86image:win7-20230220-eslocale:es-esos:windows7-x64systemwindows
submitted
07/03/2023, 21:09

Sharing

Report Analysis Logs

General

Target

WorkshopDL/Modules/KcBoxA.dll
Size

44KB
MD5

08ac00f4d05e68d8b5ab6870bf1f076e
SHA1

b8eb503bf860df5938df5cd59cea47392d129217
SHA256

1cae93696ec030be6317a338c3c8bc4274a53632c03ca60aab0bee59d361a380
SHA512

1da050749fb1e8f2917e550a86933b9f69cf4e972f1a166d0c24a2c9e1307fbad88aad36e7f1082d481c116f36e8e2b3327d630c136f02f6f465835fbd76db2e
SSDEEP

768:6QAMQ9VKxyrwDjJCPru5g193lY5/LoNqN/qCD:Pl4KxZuq5gso8NL

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 1204	1364	rundll32.exe	28
PID 1364 wrote to memory of 1204	1364	rundll32.exe	28
PID 1364 wrote to memory of 1204	1364	rundll32.exe	28
PID 1364 wrote to memory of 1204	1364	rundll32.exe	28
PID 1364 wrote to memory of 1204	1364	rundll32.exe	28
PID 1364 wrote to memory of 1204	1364	rundll32.exe	28
PID 1364 wrote to memory of 1204	1364	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WorkshopDL\Modules\KcBoxA.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\WorkshopDL\Modules\KcBoxA.dll,#1
  2⤵
  PID:1204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads