5642d1ae53a6dba7a084d997ca76305e40b897e90b1f7a932e08d980ea1a2ba0 | Triage

Analysis

max time kernel
24s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
25/04/2023, 14:05

Sharing

Report Analysis Logs

General

Target

portable/select.dll
Size

10KB
MD5

efb6435cb9fb6462132181738c729885
SHA1

0931e3aa2682fdf676b9b6009e8ca8f92f014e7e
SHA256

039981e17c2eb88cb2d08e50f2d323027e27683a7b3b3bc042e76fba40d34ab2
SHA512

6d7ad34390579e98cba75dfdbd3ace5af26ddf7f62675e33a29322911e94d1382ea84c8483265644866384ead64ffa55a1a0dd7c6d0787524fa972735f44f015
SSDEEP

192:qd35RZ+QmbQNw7MPDNqcSUMkDXUnv3XDVR6ycXc1U5:qd35nLiAPDNSvGXoPzV5mu

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 1988	1496	rundll32.exe	27
PID 1496 wrote to memory of 1988	1496	rundll32.exe	27
PID 1496 wrote to memory of 1988	1496	rundll32.exe	27
PID 1496 wrote to memory of 1988	1496	rundll32.exe	27
PID 1496 wrote to memory of 1988	1496	rundll32.exe	27
PID 1496 wrote to memory of 1988	1496	rundll32.exe	27
PID 1496 wrote to memory of 1988	1496	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\portable\select.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\portable\select.dll,#1
  2⤵
  PID:1988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads