0ad89051c06b4a5cd4bb2e6c4503adc957d0962b0388e811f07bcaebb4146bac | Triage

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:08

Sharing

Report Analysis Logs

General

Target

liblwres.dll
Size

124KB
MD5

5f1ef614d8ff248357dbe50fe998a7bb
SHA1

0fa1aec57402cd33eb443b9421be2c54b90aac3b
SHA256

7be25020c2c7cbfa4ffe1afe895e2a847c3d36832725fcbd65f8216624ee7a74
SHA512

adbc7bfc31085de32fc16b5a1a4b1958df3b02550f6aeded4284d0e25e8aa2f17240900ec2212bf3bac58c423985b0fc3cc8888ce30b1e1a457fa78ab8183e7d
SSDEEP

3072:HYWm9XyKITHeV+srRG/o5Nim2kk87DcXiAt2QrapCmUd0ZU:4/iKITHeV+srKv8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 1912	1908	rundll32.exe	28
PID 1908 wrote to memory of 1912	1908	rundll32.exe	28
PID 1908 wrote to memory of 1912	1908	rundll32.exe	28
PID 1908 wrote to memory of 1912	1908	rundll32.exe	28
PID 1908 wrote to memory of 1912	1908	rundll32.exe	28
PID 1908 wrote to memory of 1912	1908	rundll32.exe	28
PID 1908 wrote to memory of 1912	1908	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\liblwres.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\liblwres.dll,#1
  2⤵
  PID:1912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1912-0-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/1912-1-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/1912-2-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download