e8582220f161aef10bcba30369f4d9a3f2a53024b9cd4a5f9f9fecfb98ba8be2 | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 20:47

Sharing

Report Analysis Logs

General

Target

WindowBlinds/txtscroll.dll
Size

6KB
MD5

8f73ef039d65226ba78c401ef53c9d36
SHA1

c09cf24174d5a416342a06f50ae386d0a492e413
SHA256

a2fe888bb3b561245af5391de7b06af62eb942cb6db2c233e8784d847faafb8f
SHA512

27d7b16ca9e7f2a86cff52783bfa9d6f6e5be5f52fed5506bc5fffb5ac2553026bad5fcbd4a5d856fdd5243748ded0a84ccbded1ecb084f4a2cb6e4b93f2104d
SSDEEP

96:2qgO4rVw3Aq2nkucN+xA4jsULSS8t18J3mTB1614RkL/Rs:2qgO4r02nxcCRgULSS8t1lTBZkL6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2800	2336	rundll32.exe	27
PID 2336 wrote to memory of 2800	2336	rundll32.exe	27
PID 2336 wrote to memory of 2800	2336	rundll32.exe	27
PID 2336 wrote to memory of 2800	2336	rundll32.exe	27
PID 2336 wrote to memory of 2800	2336	rundll32.exe	27
PID 2336 wrote to memory of 2800	2336	rundll32.exe	27
PID 2336 wrote to memory of 2800	2336	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WindowBlinds\txtscroll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\WindowBlinds\txtscroll.dll,#1
  2⤵
  PID:2800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads