2196592d9206a2cb569f62c5b33e8054949bdcea90fd01cbd7174d7954f3a82a | Triage

Analysis

max time kernel
117s
max time network
154s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:44

Sharing

Report Analysis Logs

General

Target

liblwres.dll
Size

128KB
MD5

876389b3c8642ffea6d8ba1ff94033fa
SHA1

a60f2194acf7456ab612f9253c959837837de6a6
SHA256

f5a4b341d5a1910eb96b7af8e1d4252abf312d7ab8ee2baf5852b9304cdd8d5e
SHA512

78d3dc964928ae898aad5ff3a5118d906099dfc405e5d278a067abd9ba27609b928cd8f49969bc277a4bc5290dcbd2f1b80413a5cf84d06882f0f0985dfb0e71
SSDEEP

3072:gK5erMqsJBqI7UcbXeZRI2kk87DuXiAf2Qpa5ELUni:gh4qsJBqI7UzlD

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2908	2408	rundll32.exe	28
PID 2408 wrote to memory of 2908	2408	rundll32.exe	28
PID 2408 wrote to memory of 2908	2408	rundll32.exe	28
PID 2408 wrote to memory of 2908	2408	rundll32.exe	28
PID 2408 wrote to memory of 2908	2408	rundll32.exe	28
PID 2408 wrote to memory of 2908	2408	rundll32.exe	28
PID 2408 wrote to memory of 2908	2408	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\liblwres.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\liblwres.dll,#1
  2⤵
  PID:2908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2908-0-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download