e7e50678a688b5a7bd3b76ca1e948809590ebff535881f9d245dafbfb8b3dc11 | Triage

Analysis

max time kernel
122s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 13:44

Sharing

Report Analysis Logs

General

Target

atrc.dll
Size

76KB
MD5

143c1b061c29e8e6da3223591561837d
SHA1

e7542e2668e69ef8f159a7f2e7207d7552b4fb74
SHA256

98bc8d1425b7e2ae944074cab85f1b75ac86f4243420e088e0f1685009107a8f
SHA512

df8299935f8401368af7606a544213fd0662c67aed6819d0ee29e9266fc51349b08990fbf5a1a7a95eb09ad73173123b31d0f0bcacae852640adf5934451497e
SSDEEP

1536:yiIYskdn7pp5XIHvU/zTnw/unZ+NQvExk:DInap5XOU/vAIZpvEO

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 1344	2648	rundll32.exe	27
PID 2648 wrote to memory of 1344	2648	rundll32.exe	27
PID 2648 wrote to memory of 1344	2648	rundll32.exe	27
PID 2648 wrote to memory of 1344	2648	rundll32.exe	27
PID 2648 wrote to memory of 1344	2648	rundll32.exe	27
PID 2648 wrote to memory of 1344	2648	rundll32.exe	27
PID 2648 wrote to memory of 1344	2648	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\atrc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\atrc.dll,#1
  2⤵
  PID:1344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads