9ec75fe69dd6dd37d717db0ba784ba0e9a2ca6d2fa8a4b485952d90ae64a8222 | Triage

Analysis

max time kernel
28s
max time network
32s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
09/07/2023, 13:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

remcos_dump1.dll
Size

1.6MB
MD5

e41a38863f830ac71c9522735b950fb5
SHA1

f7141b7542e4852a8c8f840b475e1482df2b3fbd
SHA256

9ec75fe69dd6dd37d717db0ba784ba0e9a2ca6d2fa8a4b485952d90ae64a8222
SHA512

dbb67fb2cc73f389af69a3a72c6ae32d73279ba1605cde7bb9d595a268e9a7807cd7ac06c536f4ac36476f6f371e5e0e282e5133049cacc1cd71463299d97417
SSDEEP

24576:BnS/mDzRIfYTRW1jhpvhIXcX6958T2o7XmuUKWSe+K3qOX8c:jDbT2vmMXKu2o7WubFc8

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3020	2372	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 2372	1616	rundll32.exe	28
PID 1616 wrote to memory of 2372	1616	rundll32.exe	28
PID 1616 wrote to memory of 2372	1616	rundll32.exe	28
PID 1616 wrote to memory of 2372	1616	rundll32.exe	28
PID 1616 wrote to memory of 2372	1616	rundll32.exe	28
PID 1616 wrote to memory of 2372	1616	rundll32.exe	28
PID 1616 wrote to memory of 2372	1616	rundll32.exe	28
PID 2372 wrote to memory of 3020	2372	rundll32.exe	29
PID 2372 wrote to memory of 3020	2372	rundll32.exe	29
PID 2372 wrote to memory of 3020	2372	rundll32.exe	29
PID 2372 wrote to memory of 3020	2372	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\remcos_dump1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\remcos_dump1.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 224
    3⤵
    - Program crash
    PID:3020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads