cbe5cdf7ad6e2c7b436b15be3f500205a5d62d9fe07f7744171a19e1486a176f | Triage

Analysis

max time kernel
122s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 23:19

Sharing

Report Analysis Logs

General

Target

asycfilt.dll
Size

76KB
MD5

7b50242f8556a469e479f65e9668addb
SHA1

b4fabd24342d6302d6f03d948dbfe525fa9e83e3
SHA256

df92721a51d59ee2d8128fd62b4baf4911393d6325932f09585acb0e71451f5e
SHA512

8a0fefdeca8f69336d14b3b411f9fc7ecdf9f5ca7861de52ec6f8a6784496e650f702fbf4fb09064062e5fb405d6a9ed8464f20c25d880ffbd30e5f75c605de5
SSDEEP

1536:el+FKPPGxOvz4C7qREVcyYrRBEY4ia0625OgwLpyhlwSfD9Q:eMKWxg7qiqz4v0625Oehmy9Q

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2496	3036	rundll32.exe	28
PID 3036 wrote to memory of 2496	3036	rundll32.exe	28
PID 3036 wrote to memory of 2496	3036	rundll32.exe	28
PID 3036 wrote to memory of 2496	3036	rundll32.exe	28
PID 3036 wrote to memory of 2496	3036	rundll32.exe	28
PID 3036 wrote to memory of 2496	3036	rundll32.exe	28
PID 3036 wrote to memory of 2496	3036	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\asycfilt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\asycfilt.dll,#1
  2⤵
  PID:2496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads