3a988e442285b36fb8b471da5ff81bd5d1ef2971fc2f991018bf1d51c98e9a20 | Triage

Analysis

max time kernel
120s
max time network
153s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:03

Sharing

Report Analysis Logs

General

Target

liblwres.dll
Size

124KB
MD5

18838ba02c48c141c41daa704129cb1a
SHA1

9399fff264599d6e405fc02dfabcdb45c8ed177f
SHA256

c9cf5ca6b6ed436753778d3535837d3ffa9619c64a60f5e6df3f535f79dd9d47
SHA512

5c1206d27e23e5fb73af1958d434ebbcca1ef9d50328f5b864f4a86e699ca1c73720791c58b55c978d6aadc4795e7fcfef4d0e7e7342f92799d3a901eb29ccc7
SSDEEP

3072:uYWmNGkKy+6GLA+DrmnPsNex2kk87DjXiAS2QAa56GUtVZU:nPDKy+6GLA+D01t

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 2696	2616	rundll32.exe	29
PID 2616 wrote to memory of 2696	2616	rundll32.exe	29
PID 2616 wrote to memory of 2696	2616	rundll32.exe	29
PID 2616 wrote to memory of 2696	2616	rundll32.exe	29
PID 2616 wrote to memory of 2696	2616	rundll32.exe	29
PID 2616 wrote to memory of 2696	2616	rundll32.exe	29
PID 2616 wrote to memory of 2696	2616	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\liblwres.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\liblwres.dll,#1
  2⤵
  PID:2696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2696-0-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download