e8582220f161aef10bcba30369f4d9a3f2a53024b9cd4a5f9f9fecfb98ba8be2 | Triage

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 20:47

Sharing

Report Analysis Logs

General

Target

WindowBlinds/wbdb.dll
Size

149KB
MD5

ecbb1a6f1384006b9e60fbebbb69ab8f
SHA1

5c2a0854b3a228ebe5f8fa0e87331a136a959420
SHA256

a4e044bbae2233592cabf3fdc0fea5d9d786ec4ff656a7cc411c0a191390eea6
SHA512

e0fad27bee4dafdebb11c7b805c4259f05af9e3944d5b9bcd8767246d87505b85a3fe22e37a8654799be250761e3c5c2a02775de2d5ab3e4e3a31ab6b1707a4d
SSDEEP

3072:Pt09EtZHvELVsgt9SMrpXrVcdTIjA4tp9y:PuutZHcLVs6rxrMIhW

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2336	2356	rundll32.exe	28
PID 2356 wrote to memory of 2336	2356	rundll32.exe	28
PID 2356 wrote to memory of 2336	2356	rundll32.exe	28
PID 2356 wrote to memory of 2336	2356	rundll32.exe	28
PID 2356 wrote to memory of 2336	2356	rundll32.exe	28
PID 2356 wrote to memory of 2336	2356	rundll32.exe	28
PID 2356 wrote to memory of 2336	2356	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WindowBlinds\wbdb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\WindowBlinds\wbdb.dll,#1
  2⤵
  PID:2336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads