eb40f8017e4e96c12878d2fa338f63c8ede67a98d0cb06e359beef7adeef9315 | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 10:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Helper.dll
Size

273KB
MD5

aa6cd4b49f73d5dcd30b4cd44cd7f24f
SHA1

9454ba799888a8fb80894e37e4d0d5af78fd95c1
SHA256

a7439d5c54c862f21498c054fb38069766c618baa16736875fc546a1e901c4bb
SHA512

11576615bf7c0e8721908af9e01e8acedb89d91b060dd5d53c3e7b39f27630aa8490ebd2fcaac5eabf7c59f322dbd2e65266cc149b1445f7f8169e1fef703e0c
SSDEEP

3072:StcKQnMCEgeoQEs9ssGkSbiN5Hvd2YmMIU6swjfNi59mNi2Rw8DH0d:Stk5eoQEs9zGkSWfVDmxswjwmN1C

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2744	1976	rundll32.exe	16
PID 1976 wrote to memory of 2744	1976	rundll32.exe	16
PID 1976 wrote to memory of 2744	1976	rundll32.exe	16
PID 1976 wrote to memory of 2744	1976	rundll32.exe	16
PID 1976 wrote to memory of 2744	1976	rundll32.exe	16
PID 1976 wrote to memory of 2744	1976	rundll32.exe	16
PID 1976 wrote to memory of 2744	1976	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Helper.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Helper.dll,#1
  2⤵
  PID:2744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads