7c0f72bad64237b4b2749840811299838e0062bd1551182ac82cae17a7e555bf | Triage

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 14:51

Sharing

Report Analysis Logs

General

Target

refox/file/idevice_distribute.dll
Size

442KB
MD5

dbcadf24d4edccedfe86f10aac1dc189
SHA1

d50453091006ff25844d2dd0c686f89d6e415e0a
SHA256

7324381ced2c9822689f7070dc7a0037402857ba21e36d4978e4e3df4435a648
SHA512

140a26339b0e554f9796131a33cb1ef4a0732ed51edcbed3ce51853b1d1459567bad8b6646982119073b0bdd9b5e583a79bfcc508bc9600711918324d1eb3026
SSDEEP

12288:htHmImEFwKKSCvuRKaiY9z8/5fP/dkyAm0YsPZPh:ht8aiY8/53/Se0jPZZ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1756 wrote to memory of 2288	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 2288	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 2288	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 2288	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 2288	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 2288	1756	rundll32.exe	rundll32.exe
PID 1756 wrote to memory of 2288	1756	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\refox\file\idevice_distribute.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\refox\file\idevice_distribute.dll,#1
  2⤵
  PID:2288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads