194d2bcf5594e4d2d9cbd85e619209b08ba219776edaa9a3f39e3436e9172934 | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
09-08-2023 05:25

Sharing

Report Analysis Logs

General

Target

lzo.dll
Size

87KB
MD5

f0d3f2b94cd599201c5cb6ae4bd0143a
SHA1

72af5cb900397171da08ce9c3aa90d3ca95cee66
SHA256

e0b5a7bccc75564052e79cf2e35cb2bfa2d5a3435c44ed5bf7efbb7baf770874
SHA512

13fe68fbd193fe32e65019e3e862980db489c64c8aae8b2220465636d0d91b1c7c3847f1dd771113b2238a0dbe2e7bcf75797f8751c84fc1fc9d93793693e8c7
SSDEEP

1536:z2kD1qx8Jw/IO2nVncK2HTQOnGVZnzba43QtkdNqo:z232JO2n+K5OnGFQtkrqo

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 1716	1908	rundll32.exe	28
PID 1908 wrote to memory of 1716	1908	rundll32.exe	28
PID 1908 wrote to memory of 1716	1908	rundll32.exe	28
PID 1908 wrote to memory of 1716	1908	rundll32.exe	28
PID 1908 wrote to memory of 1716	1908	rundll32.exe	28
PID 1908 wrote to memory of 1716	1908	rundll32.exe	28
PID 1908 wrote to memory of 1716	1908	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lzo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\lzo.dll,#1
  2⤵
  PID:1716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads