86dabd438734f81d03f76db01608c4f0b0fbcbcb0a69c6219e7673f809d85445 | Triage

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07-11-2023 14:33

Sharing

Report Analysis Logs

General

Target

liblwres.dll
Size

124KB
MD5

208d67df651fe6c910be372af93533a3
SHA1

cf967314383c06d06770f67903b75e38d5f9ff9c
SHA256

b225ff646983ae2f83b38adb05cd6cc940633edb1ae89b2f55ed06717dbe07f8
SHA512

707aa6eb7c04090b3211893e78da258f4cb3c836784b703aab8f36e6b9c17f7844b6251a64d328210177b67659457d17740c168501053c5cb8972b60b639f6e5
SSDEEP

3072:Q5tu4nmnOolQYGOaGEg2bO2kk87DEXiAV2QDaJGmU7lsw:QTuCmnOolQYGGobs

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2768	2724	rundll32.exe	29
PID 2724 wrote to memory of 2768	2724	rundll32.exe	29
PID 2724 wrote to memory of 2768	2724	rundll32.exe	29
PID 2724 wrote to memory of 2768	2724	rundll32.exe	29
PID 2724 wrote to memory of 2768	2724	rundll32.exe	29
PID 2724 wrote to memory of 2768	2724	rundll32.exe	29
PID 2724 wrote to memory of 2768	2724	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\liblwres.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\liblwres.dll,#1
  2⤵
  PID:2768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2768-0-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download
memory/2768-1-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download