e8582220f161aef10bcba30369f4d9a3f2a53024b9cd4a5f9f9fecfb98ba8be2 | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 20:47

Sharing

Report Analysis Logs

General

Target

WindowBlinds/wbhelp.dll
Size

28KB
MD5

4f3909b0a61f32ccf85cacaceb8c6d04
SHA1

dcf28f563c85286056f44474d8d149b691509f0a
SHA256

7a06da54588f6d4d9352e8e5e07f35e7b62306a76bc33c4a336ce2c340d8e325
SHA512

8c2774ae938e16144b0aca8aa190563819941276e792394be03e9ea2ab8245c398f31c43701688d4eb9af744ccbdd3b3a4f0b7be46fa0855b784cbcf8b055112
SSDEEP

768:ejtEgEDBzRPCKK3ojh2sTZdUa4wfyixrl4:7gEDBztNK3oksTZdXfyix54

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2724	2888	rundll32.exe	18
PID 2888 wrote to memory of 2724	2888	rundll32.exe	18
PID 2888 wrote to memory of 2724	2888	rundll32.exe	18
PID 2888 wrote to memory of 2724	2888	rundll32.exe	18
PID 2888 wrote to memory of 2724	2888	rundll32.exe	18
PID 2888 wrote to memory of 2724	2888	rundll32.exe	18
PID 2888 wrote to memory of 2724	2888	rundll32.exe	18

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WindowBlinds\wbhelp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\WindowBlinds\wbhelp.dll,#1
  2⤵
  PID:2724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2724-0-0x0000000066600000-0x0000000066617000-memory.dmp

Filesize
92KB

Download