40702b0d2a57d292c5bdfbf1ab1db3da71dacc942dc6838b10458f185800d6e5 | Triage

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
18-03-2023 20:34

Sharing

Report Analysis Logs

General

Target

MultiBit/_asyncio.dll
Size

59KB
MD5

f5d81b2fb250ad4bdac8fb29b9bb4885
SHA1

e8893fed89d122c597a595efa53b710934873f46
SHA256

f367c877c2c547b8f65d00e0c1d8c6f9b448ad30eef047deac28e35f5b8dd24a
SHA512

dbbda8f37541198bc477294a1ba630f6f6ec772c77b26944b55588ae63d1770940d06de3ccffd6065bec43c685e37986071b7c741049031962188ae1d992d7d2
SSDEEP

1536:dw7HUgU+wU9IYrya9M4fvzBa5GUBaWRztIW5nbR7SyXMTJ:dwL7lw4DBfbI5GUBaWRztIW5nbRSTJ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1724 wrote to memory of 1756	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1756	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1756	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1756	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1756	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1756	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 1756	1724	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiBit\_asyncio.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiBit\_asyncio.dll,#1
2⤵
PID:1756

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...