fda45010d8297cf7afd9ebb35510cf2628daf5fb247f7dad2c765e91674e2b52 | Triage

Analysis

max time kernel
119s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 00:39

Sharing

Report Analysis Logs

General

Target

S3tupp__Pswrd--1231/cr.dll
Size

701.1MB
MD5

c25fc4a6a168b5d6ee832d0a0d594e72
SHA1

db1c13482637af9a638bdb28f867b5aa1714622d
SHA256

6ea2e795d258469f90f47cdb666b2d291e541376f2ca499a55d0b48353c70cb5
SHA512

c9c77809d9aec496a9851ba4953f3f6ecab40614fe3e9c13fe22c8489a1da91a195a07f9c7fad3dfaba1c6955a78d8b04780c42e9f725a8d70adb70bacb59707
SSDEEP

24576:1LTibD9P8rT21S6MYckrjZqIsN7g4F7rZr8Hxz5kWFiTT8Q:wD9P/Ah5G45KHxzO

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2740	2684	rundll32.exe	27
PID 2684 wrote to memory of 2740	2684	rundll32.exe	27
PID 2684 wrote to memory of 2740	2684	rundll32.exe	27
PID 2684 wrote to memory of 2740	2684	rundll32.exe	27
PID 2684 wrote to memory of 2740	2684	rundll32.exe	27
PID 2684 wrote to memory of 2740	2684	rundll32.exe	27
PID 2684 wrote to memory of 2740	2684	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\S3tupp__Pswrd--1231\cr.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\S3tupp__Pswrd--1231\cr.dll,#1
  2⤵
  PID:2740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads