5642d1ae53a6dba7a084d997ca76305e40b897e90b1f7a932e08d980ea1a2ba0 | Triage

Analysis

max time kernel
27s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
25/04/2023, 14:05

Sharing

Report Analysis Logs

General

Target

portable/wx._misc_.dll
Size

716KB
MD5

1e4649cb160a03697ae1e61b0b6cd981
SHA1

2e5152cbc7460ab55da7c2538e8d18d203bf2c0e
SHA256

abdfc5cdb1ef9b634162c415fc03b1d4cf715341939a43c30ead2ba26602a96d
SHA512

be6702db41712987a60a6fa1146dd8078c00cb4a2dc81c72989851b5705ec938fcc9b016d79556eb6851d7b539b436b5fefff1bfce9484e4d7634c95852149bc
SSDEEP

12288:Jah2oAI8lR/6X5lVetx5A3tQdZIL3RtFihI0Q3DMLJI:o2oAI8l0J5AWyQ3g9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 1992	1192	rundll32.exe	27
PID 1192 wrote to memory of 1992	1192	rundll32.exe	27
PID 1192 wrote to memory of 1992	1192	rundll32.exe	27
PID 1192 wrote to memory of 1992	1192	rundll32.exe	27
PID 1192 wrote to memory of 1992	1192	rundll32.exe	27
PID 1192 wrote to memory of 1992	1192	rundll32.exe	27
PID 1192 wrote to memory of 1992	1192	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\portable\wx._misc_.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\portable\wx._misc_.dll,#1
  2⤵
  PID:1992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1992-54-0x00000000020C0000-0x00000000022B7000-memory.dmp

Filesize
2.0MB

Download