6c611841f8150bff3266e0421a14b57c28c8767974adbd7e056db54162184934 | Triage

Analysis

max time kernel
122s
max time network
133s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
31-08-2023 20:47

Sharing

Report Analysis Logs

General

Target

tpkproxy2015.dll
Size

184KB
MD5

0b8c7a5db9a1bc12c5a4653b81c52ab0
SHA1

dd265554bdbc715496edc08928b17a30742243b5
SHA256

e8d5d43f6c0f1a25bfbe2eeed05578bff2c469043e198eb027dc87d8fc3ac612
SHA512

26dc58a26dc9843fd48326f932bb101446f5e9dfa3cec7596a66bd917afb1b02a1089b17262fff506bb9faef618d05bbf1d28cb1697e21ee127f595a2583bae0
SSDEEP

3072:6VKg8vVSsFqYGNtLB+UWHy+R3nrC3HPiPTkesSxMxEB+vsoicxD:2KdvVSGqT3oy+dr6H6PT28X+vsPS

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1636	1648	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 1648	2076	rundll32.exe	28
PID 2076 wrote to memory of 1648	2076	rundll32.exe	28
PID 2076 wrote to memory of 1648	2076	rundll32.exe	28
PID 2076 wrote to memory of 1648	2076	rundll32.exe	28
PID 2076 wrote to memory of 1648	2076	rundll32.exe	28
PID 2076 wrote to memory of 1648	2076	rundll32.exe	28
PID 2076 wrote to memory of 1648	2076	rundll32.exe	28
PID 1648 wrote to memory of 1636	1648	rundll32.exe	29
PID 1648 wrote to memory of 1636	1648	rundll32.exe	29
PID 1648 wrote to memory of 1636	1648	rundll32.exe	29
PID 1648 wrote to memory of 1636	1648	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\tpkproxy2015.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\tpkproxy2015.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 224
    3⤵
    - Program crash
    PID:1636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads