194d2bcf5594e4d2d9cbd85e619209b08ba219776edaa9a3f39e3436e9172934 | Triage

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
09/08/2023, 05:25

Sharing

Report Analysis Logs

General

Target

msvcp80.dll
Size

536KB
MD5

38e1a82ea77e591245fd7487a7e32fe8
SHA1

920a0c5a8c5afc3ba22a5a208ff8acba25a641d4
SHA256

4abb7b40d139d4e25a3c6150a48f935508d22a71cdf6c50029185fcdd79e3671
SHA512

dd337162421540eccb25149d65d2fd52db2a232a52e6b0b35925a3dd48dcac6bb9dc373e41a2cb4ed5fd1f0f337c25579fc5be431dc81ea112930db8e37bef64
SSDEEP

12288:HZY4lOHMwLwXBt+ia21tsUa/hUgiW6QR7t5j3Ooc8NHkC2e2:HZY4lOHMM8wib1tAj3Ooc8NHkC2e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 1740	2184	rundll32.exe	28
PID 2184 wrote to memory of 1740	2184	rundll32.exe	28
PID 2184 wrote to memory of 1740	2184	rundll32.exe	28
PID 2184 wrote to memory of 1740	2184	rundll32.exe	28
PID 2184 wrote to memory of 1740	2184	rundll32.exe	28
PID 2184 wrote to memory of 1740	2184	rundll32.exe	28
PID 2184 wrote to memory of 1740	2184	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcp80.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcp80.dll,#1
  2⤵
  PID:1740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads