9733e3f15efe06bfbf6f1e890eee2f4b550f053acb18be931b1cb1c0c8f004ab | Triage

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
31-08-2023 02:57

Sharing

Report Analysis Logs

General

Target

todolist_exe/BurndownExt.dll
Size

364KB
MD5

1637efb75d9614f38f75ff52084c86ee
SHA1

bbf5e87591d5028f92dc4e77bab660e2d57d9e4c
SHA256

ee87aa4cc42b291109bea91f52862f47f15e5c91e23595f2b746d37d76e1dca5
SHA512

51a3f1e2d12fb84953598bfaeb32fd79e43a234207f317b243ea6d57be2266897da66dee7c2fb156365fc077dcb4002f8a839fd19fd42d92e22c7bf523d712bb
SSDEEP

6144:5qInjnTmaG5ILxCQwVxl18jAnsMov9s42M32Bm:5q0uaYCxCQwYjI342Mmm

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 2192	1324	rundll32.exe	28
PID 1324 wrote to memory of 2192	1324	rundll32.exe	28
PID 1324 wrote to memory of 2192	1324	rundll32.exe	28
PID 1324 wrote to memory of 2192	1324	rundll32.exe	28
PID 1324 wrote to memory of 2192	1324	rundll32.exe	28
PID 1324 wrote to memory of 2192	1324	rundll32.exe	28
PID 1324 wrote to memory of 2192	1324	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\todolist_exe\BurndownExt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\todolist_exe\BurndownExt.dll,#1
  2⤵
  PID:2192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads