7c0f72bad64237b4b2749840811299838e0062bd1551182ac82cae17a7e555bf | Triage

Analysis

max time kernel
139s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2023 14:51

Sharing

Report Analysis Logs

General

Target

refox/file/idevice_distribute.dll
Size

442KB
MD5

dbcadf24d4edccedfe86f10aac1dc189
SHA1

d50453091006ff25844d2dd0c686f89d6e415e0a
SHA256

7324381ced2c9822689f7070dc7a0037402857ba21e36d4978e4e3df4435a648
SHA512

140a26339b0e554f9796131a33cb1ef4a0732ed51edcbed3ce51853b1d1459567bad8b6646982119073b0bdd9b5e583a79bfcc508bc9600711918324d1eb3026
SSDEEP

12288:htHmImEFwKKSCvuRKaiY9z8/5fP/dkyAm0YsPZPh:ht8aiY8/53/Se0jPZZ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3436 wrote to memory of 4728	3436	rundll32.exe	rundll32.exe
PID 3436 wrote to memory of 4728	3436	rundll32.exe	rundll32.exe
PID 3436 wrote to memory of 4728	3436	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\refox\file\idevice_distribute.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\refox\file\idevice_distribute.dll,#1
  2⤵
  PID:4728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads