33b1cc24f787e0879be88253b5c445f9d4f9b0d8d678049dbf78fcdb94b65fe7 | Triage

Analysis

max time kernel
122s
max time network
142s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07-11-2023 14:17

Sharing

Report Analysis Logs

General

Target

Tool_1CD_2016v030_edit_mode/icuin46.dll
Size

1.2MB
MD5

2760046a4dd0fc31f770a3a439415ba8
SHA1

e3766a400c246678a04b758f89e73c2cd05ed84d
SHA256

b13f00990955ab856cb5bbe34f2e88784eb21e08e348f366aa4457dbca39794b
SHA512

35525a1336e8f4bf3c4c15087c1b1dce091f1fec2fda35ebf8c259de0cb8db474943ac6403a02892115124f6bb69dea39093f14c16f5c3e9dd1205e7ab0aa2a2
SSDEEP

24576:smdAsFxqBSKsJ5H9xlfOo2cEqz+N0wAmGgUpWj0w:besVznAj0w

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2880 wrote to memory of 2892	2880	rundll32.exe	29
PID 2880 wrote to memory of 2892	2880	rundll32.exe	29
PID 2880 wrote to memory of 2892	2880	rundll32.exe	29
PID 2880 wrote to memory of 2892	2880	rundll32.exe	29
PID 2880 wrote to memory of 2892	2880	rundll32.exe	29
PID 2880 wrote to memory of 2892	2880	rundll32.exe	29
PID 2880 wrote to memory of 2892	2880	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Tool_1CD_2016v030_edit_mode\icuin46.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Tool_1CD_2016v030_edit_mode\icuin46.dll,#1
  2⤵
  PID:2892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads