1c0b9425bb2f4e39eb64cae968fc3c9ea83f9067dd95db6adb616e7d7f71f322 | Triage

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 00:27

Sharing

Report Analysis Logs

General

Target

ConsoleMD/ConsoleMDBuss64.dll
Size

150KB
MD5

9723937e1fb0507e189ff9f0fbcc129f
SHA1

b782c0388c05a47138e98edfe40dc2ae800d304f
SHA256

96b196264b7ad562f5608bc08370e184bbec6a00e6c154fbf83fe41415075d6d
SHA512

e848012ca2b5c6534d50337d283198a1a51c566f379ef63adb222e527c0cd998a486461f833def73f51fc0d4485407fe3473656cf44973115703d5c69136141e
SSDEEP

3072:HdxdXFzNEaa9GeoGvmkwzjvw7oY4ese2bMcFh:912akfoqwzjYoheA

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 2308	2816	rundll32.exe	28
PID 2816 wrote to memory of 2308	2816	rundll32.exe	28
PID 2816 wrote to memory of 2308	2816	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ConsoleMD\ConsoleMDBuss64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2816 -s 84
  2⤵
  PID:2308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads