eb6e2518265fab17ada724aef992d1b139a76ec0b6ea0b7559b4c47ec35b43f8 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 02:12

Sharing

Report Analysis Logs

General

Target

mfc70u.dll
Size

942KB
MD5

88307669b7f678303e4948d0445ed96e
SHA1

f2ab394f6df36745fefed6a3b1e0b4204832ca31
SHA256

6a5dfd13079a99565efd87704e30f84321672c8056bb811b215c0b8d8986a941
SHA512

a1290aab3b2cb45ffdccf8823a20363f1cdfe1e684878cf7a60982f52e0a3d8111974f8b248712df2a745e47420d7d19247c5cd178d6db7965127ef54ee9b86d
SSDEEP

12288:2stayiQvBTChIIlAvWLOaNymt0bcWiHkr3nAoFjgXL78Cng:2OaydTChIIevWxyANoSR

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2372	2108	rundll32.exe	16
PID 2108 wrote to memory of 2372	2108	rundll32.exe	16
PID 2108 wrote to memory of 2372	2108	rundll32.exe	16
PID 2108 wrote to memory of 2372	2108	rundll32.exe	16
PID 2108 wrote to memory of 2372	2108	rundll32.exe	16
PID 2108 wrote to memory of 2372	2108	rundll32.exe	16
PID 2108 wrote to memory of 2372	2108	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mfc70u.dll,#1
1⤵
PID:2372

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mfc70u.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads