a3924df964a4e90c60ab76c7627706dd4986c06c3c513b9dae66d2cb9dc80fe1 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 08:01

Sharing

Report Analysis Logs

General

Target

lib/GimFormat.dll
Size

92KB
MD5

102cb329594368b2fc23b24596b834bc
SHA1

f24c778ebd3e1ec3a74f10a807506f9fd2eb52b1
SHA256

317cd01ddd74d82525036e1401cd5a73e021ea1be9e634a11834c2bc1b6e3a20
SHA512

1e66de251ab604a783749efe86edf02e88f7dfe4306a7711314e4cfb3f343256ce5b31c459556fa097084c8f4d038346dd8b229d93415800af2625e6dbb4f834
SSDEEP

1536:6EBAH6lMT8K8Fb/DMryRlDEEg1ApCXRkkNlc++20LW+D:dfMP8Fb/Dt2qfUlc++20LvD

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2312	2336	rundll32.exe	28
PID 2336 wrote to memory of 2312	2336	rundll32.exe	28
PID 2336 wrote to memory of 2312	2336	rundll32.exe	28
PID 2336 wrote to memory of 2312	2336	rundll32.exe	28
PID 2336 wrote to memory of 2312	2336	rundll32.exe	28
PID 2336 wrote to memory of 2312	2336	rundll32.exe	28
PID 2336 wrote to memory of 2312	2336	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\GimFormat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\GimFormat.dll,#1
  2⤵
  PID:2312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads