4c92997d0ef696acfb50633416902e6b7b3cccca6fd98721bd2658c846fd9576 | Triage

Analysis

max time kernel
122s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 14:44

Sharing

Report Analysis Logs

General

Target

mtkjw/iext.dll
Size

200KB
MD5

25f757f0757c8cff125877f5f66634b8
SHA1

f501113495508b195206e5ad2c98173a8744d5e7
SHA256

3c618cd0d46bfa021771cd49dbfa91cee01b67dfdd277537ab1c225987df390b
SHA512

9ce7ab6078c492aa18173103734048d38cfda4c483fe80b699f8f0bdb13822089050f34bc058f8a5d75ad13372ad721d69e654cb8a94e556e57126beddd29b4b
SSDEEP

3072:BvSDAZHSEue9yxLGewAtm/tQehHNiOc2MkifHo65NbTlxZzM:yeijVtm/JBD0bp/

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2104	2072	rundll32.exe	28
PID 2072 wrote to memory of 2104	2072	rundll32.exe	28
PID 2072 wrote to memory of 2104	2072	rundll32.exe	28
PID 2072 wrote to memory of 2104	2072	rundll32.exe	28
PID 2072 wrote to memory of 2104	2072	rundll32.exe	28
PID 2072 wrote to memory of 2104	2072	rundll32.exe	28
PID 2072 wrote to memory of 2104	2072	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mtkjw\iext.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\mtkjw\iext.dll,#1
  2⤵
  PID:2104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads