5642d1ae53a6dba7a084d997ca76305e40b897e90b1f7a932e08d980ea1a2ba0 | Triage

Analysis

max time kernel
27s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
25/04/2023, 14:05

Sharing

Report Analysis Logs

General

Target

portable/bz2.dll
Size

69KB
MD5

58c57a662cde57fea311444cc8dadc24
SHA1

1c3a7b564ec9abc4172c98db7069170e50b70efa
SHA256

69b4ec17de1368a9ea62313954629e1ace3f414a7eaedcedbfc79b110cadbaac
SHA512

239584de4d57d8f4e92d7dee8ba99f3964b9b30cd3642a38f536dd1aec35e1747ca1555ca13fc2b872a9624685117646ca3d2407ea91d19915d2a9aedfab0430
SSDEEP

1536:InfB9P4y4yhXYjrKV4S1uB8xguvaG+6r8S+f0PP8zKTiL:IfRYn04Su8xguvaG+64Zfm5Ti

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 2024	848	rundll32.exe	27
PID 848 wrote to memory of 2024	848	rundll32.exe	27
PID 848 wrote to memory of 2024	848	rundll32.exe	27
PID 848 wrote to memory of 2024	848	rundll32.exe	27
PID 848 wrote to memory of 2024	848	rundll32.exe	27
PID 848 wrote to memory of 2024	848	rundll32.exe	27
PID 848 wrote to memory of 2024	848	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\portable\bz2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\portable\bz2.dll,#1
  2⤵
  PID:2024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads