9733e3f15efe06bfbf6f1e890eee2f4b550f053acb18be931b1cb1c0c8f004ab | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
31/08/2023, 02:57

Sharing

Report Analysis Logs

General

Target

todolist_exe/DayViewUIExtensionCore.dll
Size

79KB
MD5

117990e6fce52c3f79ce7df971ad6706
SHA1

a43766765a8174eef5117103ef5a5263a5418426
SHA256

4501d67a8d7473f9e86cbaaf95a463184f2bd485ba4310f3e3d713039570272c
SHA512

27aaeb289abdf963c8c619faee41f61e4cb0f355bea8b31b1cb31af710fe64ef1fb17274ea2021ed9a71dfe6755fa5932da2f405fca0629358ffb9dbe0054ac7
SSDEEP

1536:Ms0OT0CVBodr2sRPiwafHKkDKvFuI9iECRc5Jth:n1fGZavKkDKNME

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 1308	1620	rundll32.exe	28
PID 1620 wrote to memory of 1308	1620	rundll32.exe	28
PID 1620 wrote to memory of 1308	1620	rundll32.exe	28
PID 1620 wrote to memory of 1308	1620	rundll32.exe	28
PID 1620 wrote to memory of 1308	1620	rundll32.exe	28
PID 1620 wrote to memory of 1308	1620	rundll32.exe	28
PID 1620 wrote to memory of 1308	1620	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\todolist_exe\DayViewUIExtensionCore.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\todolist_exe\DayViewUIExtensionCore.dll,#1
  2⤵
  PID:1308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads