b76c29329ab1e6ad675dd8fdf34133da6d5d1da410b654fef9a7ca4c780f4e0a | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-09-2023 18:19

Sharing

Report Analysis Logs

General

Target

PCICL32.dll
Size

3.6MB
MD5

00587238d16012152c2e951a087f2cc9
SHA1

c4e27a43075ce993ff6bb033360af386b2fc58ff
SHA256

63aa18c32af7144156e7ee2d5ba0fa4f5872a7deb56894f6f96505cbc9afe6f8
SHA512

637950a1f78d3f3d02c30a49a16e91cf3dfccc59104041876789bd7fdf9224d187209547766b91404c67319e13d1606da7cec397315495962cbf3e2ccd5f1226
SSDEEP

49152:cTXNZ+0ci2aYNT8wstdAukudJ1xTvIZamclSp+73mPu:cTXNo0cpKwstTJIkS43mm

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3040 wrote to memory of 2140	3040	rundll32.exe	rundll32.exe
PID 3040 wrote to memory of 2140	3040	rundll32.exe	rundll32.exe
PID 3040 wrote to memory of 2140	3040	rundll32.exe	rundll32.exe
PID 3040 wrote to memory of 2140	3040	rundll32.exe	rundll32.exe
PID 3040 wrote to memory of 2140	3040	rundll32.exe	rundll32.exe
PID 3040 wrote to memory of 2140	3040	rundll32.exe	rundll32.exe
PID 3040 wrote to memory of 2140	3040	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PCICL32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PCICL32.dll,#1
  2⤵
  PID:2140

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads