e8582220f161aef10bcba30369f4d9a3f2a53024b9cd4a5f9f9fecfb98ba8be2 | Triage

Analysis

max time kernel
122s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 20:47

Sharing

Report Analysis Logs

General

Target

WindowBlinds/anim.dll
Size

27KB
MD5

4b9dfff37633f83e57c0d47c48d47415
SHA1

8e21411b7c72d76cd189e769221ee585ab56164e
SHA256

ed922a46f5c7d2346d93dcb42b0f66076dcc4d40a8d6cedcea2d19a867048171
SHA512

6d9f6c3cb4618d31a4a15a90e674ed8dd905fb98e6293aa28d8d87df8e8278649df0b90e2a2568c4fc2c7d517c323eaf24cb295a07b1e15f7c13ea8a73a5c8bb
SSDEEP

384:pocBdzctzL9TnYUqQbtQlM+EIZ9LqbVsQBrZzwIf:VBZKhnQ6lI/L4FwIf

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 2648	1792	rundll32.exe	29
PID 1792 wrote to memory of 2648	1792	rundll32.exe	29
PID 1792 wrote to memory of 2648	1792	rundll32.exe	29
PID 1792 wrote to memory of 2648	1792	rundll32.exe	29
PID 1792 wrote to memory of 2648	1792	rundll32.exe	29
PID 1792 wrote to memory of 2648	1792	rundll32.exe	29
PID 1792 wrote to memory of 2648	1792	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WindowBlinds\anim.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\WindowBlinds\anim.dll,#1
  2⤵
  PID:2648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads