6a0664da0332aa8f4428914ba6aff37506fd239776a881e6d24f1cf5b60cbb70 | Triage

Resubmissions

24-09-2023 15:33

230924-szdm4shh59 3

Analysis

max time kernel
118s
max time network
134s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
24-09-2023 15:33

Sharing

Report Analysis Logs

General

Target

behavior.dll
Size

331KB
MD5

1b9d24c87bc25a9b4a5f049eff61831d
SHA1

bb36ead6328e0f5e64bafaff6a60a74da10275e5
SHA256

bbd952dade3cae9fd1f894ef7fa1d1da03816d8ad11721a5405198af83d6e497
SHA512

33b7b4db38a1775ab53916316d3913acc99db3f1737d672f82e3a1bd199a5dcfd11307b5c0b25abea83b6a2a3e43200c12e2f76085e35caba904fcdd345934f8
SSDEEP

6144:QWaLCPyj3TUd8okFO809RbWeILgb7JGSe7FGKGGSHZecoFy/D:wLCPUjUd8oSOTfxZ70SmGKfAQF6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2584 wrote to memory of 2592	2584	rundll32.exe	rundll32.exe
PID 2584 wrote to memory of 2592	2584	rundll32.exe	rundll32.exe
PID 2584 wrote to memory of 2592	2584	rundll32.exe	rundll32.exe
PID 2584 wrote to memory of 2592	2584	rundll32.exe	rundll32.exe
PID 2584 wrote to memory of 2592	2584	rundll32.exe	rundll32.exe
PID 2584 wrote to memory of 2592	2584	rundll32.exe	rundll32.exe
PID 2584 wrote to memory of 2592	2584	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\behavior.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2584

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\behavior.dll,#1
2⤵
PID:2592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads