e5b9c1585123378095c5c51bda7351db24b4140757fe35b57f2d51be79f19275 | Triage

Resubmissions

04/01/2024, 15:30

240104-sxtasaegd3 3

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 15:30

Sharing

Report Analysis Logs

General

Target

dlc/pops_api.dll
Size

4.6MB
MD5

618258464c7095a90d290dae3ef1cb0c
SHA1

3b37e950cf72c0fc77334469f31e73e684451bc6
SHA256

6c02711e6ea36af0942276a59ed7ce8d08ce359ecccc7d795df3cab3a8bed1d3
SHA512

ec1e84d7bf86ee3a2b259ed4c07226c1ec1f63aac73efbb707782c0e4d7f320692f880bbbcf1ce78d60436db5cb1ccfe4ca936fc152cfd95b6e6722017fc8c00
SSDEEP

98304:QH5sLNDhrqIb1JHuYHEcNk4+oiBAUZLk7KY9:G5sLNDhrqIb1JHurc24piVg

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 2884	1800	rundll32.exe	17
PID 1800 wrote to memory of 2884	1800	rundll32.exe	17
PID 1800 wrote to memory of 2884	1800	rundll32.exe	17

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dlc\pops_api.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1800 -s 124
  2⤵
  PID:2884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads