fa5710fea9ff93e8d446803066d2cf74088f67db96336c000fbff597982eb128 | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
26-11-2023 19:49

Sharing

Report Analysis Logs

General

Target

Plumulaceous.dll
Size

795KB
MD5

c83fe58088ef5f05342367e71eb28873
SHA1

8af8c027cb0f56b6775115383f4d5bdf010a6352
SHA256

fa5710fea9ff93e8d446803066d2cf74088f67db96336c000fbff597982eb128
SHA512

0089a1ed148c7ea705ef9bdcaa3231ebf8d78d6e5e32a487ad4dff5aebcae33470aa1c5074d6ed55d7be37ae80526d826a1ce1c93faa6f7181848f0a0d23292d
SSDEEP

24576:/tR2jQOoVmT/QrwFbxE6Elpq5nOkcJofEXmi:1TMT/jb+Bl05nBcJocXmi

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 3024	2072	rundll32.exe	28
PID 2072 wrote to memory of 3024	2072	rundll32.exe	28
PID 2072 wrote to memory of 3024	2072	rundll32.exe	28
PID 2072 wrote to memory of 3024	2072	rundll32.exe	28
PID 2072 wrote to memory of 3024	2072	rundll32.exe	28
PID 2072 wrote to memory of 3024	2072	rundll32.exe	28
PID 2072 wrote to memory of 3024	2072	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plumulaceous.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plumulaceous.dll,#1
  2⤵
  PID:3024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads