def4f0e2221314598f08b56d0fc35f169b2c67df22ce67d685fea66b374a6556 | Triage

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 22:18

Sharing

Report Analysis Logs

General

Target

Thunder/Program/BugReportU.dll
Size

65KB
MD5

753eccd625b83be8f228ce20a580d661
SHA1

c8fa563948f812ff8240eaf63dc316022a73fb75
SHA256

7067a0a9fa9f733bd2a78b461cfcf2d1a464e69e68398c71b075974663509423
SHA512

c0a4ac0d8a874d2fc7b25d649798c8b442c6625f991eb38a6ec0a05b2609a354410741f0d4ccdff17439a3659e400dce56258b5c7b77aba3f1a768e5b293f510
SSDEEP

1536:8j1YpvXiXSz1wKFo7Rv4frKJZA+52Lt5nRpq:61YpeSz1N+UrKJZ92Lt5a

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2136	1984	rundll32.exe	28
PID 1984 wrote to memory of 2136	1984	rundll32.exe	28
PID 1984 wrote to memory of 2136	1984	rundll32.exe	28
PID 1984 wrote to memory of 2136	1984	rundll32.exe	28
PID 1984 wrote to memory of 2136	1984	rundll32.exe	28
PID 1984 wrote to memory of 2136	1984	rundll32.exe	28
PID 1984 wrote to memory of 2136	1984	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Thunder\Program\BugReportU.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Thunder\Program\BugReportU.dll,#1
  2⤵
  PID:2136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2136-0-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download