d7328efeb259c12686d5797c9abcf0fad794ca7b9361f0517027c71b58b42347 | Triage

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
06/08/2023, 02:33

Sharing

Report Analysis Logs

General

Target

krnln.dll
Size

1.2MB
MD5

a6a397b67ebac717e7ec095bf9b597ee
SHA1

80c7459654f3564c0cb74a47398d48e0f02cb82f
SHA256

847fbe068ff90112d9b76c04587439ee3a3866d8c60466bb4673491d94ddfd89
SHA512

0eb5528a4aad4458feddbefb5347d0e2cd84d6240a341ccc425d6ed98d15d8588d8635f21d30af389a2af5ac9537bea56a1d97530ac90e965989e296f1c5d8c8
SSDEEP

24576:ZlR7H/LiuGfd8X6dlmg8UHDLC2aS6Vixyfr6CcwwWB5XT:hbm/Kwmgtxkix/CcwwWTT

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 596	2180	rundll32.exe	29
PID 2180 wrote to memory of 596	2180	rundll32.exe	29
PID 2180 wrote to memory of 596	2180	rundll32.exe	29
PID 2180 wrote to memory of 596	2180	rundll32.exe	29
PID 2180 wrote to memory of 596	2180	rundll32.exe	29
PID 2180 wrote to memory of 596	2180	rundll32.exe	29
PID 2180 wrote to memory of 596	2180	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\krnln.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\krnln.dll,#1
  2⤵
  PID:596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads