e50f4c6c5ff5c515a5cf1428b4796c336c42c5d9797960c7882ea10044cdaa2c | Triage

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18-01-2024 08:54

Sharing

Report Analysis Logs

General

Target

es/TNrgyModbusServer.resources.dll
Size

4KB
MD5

b4fc270d0198ac485b853837bde48531
SHA1

4c5a4ac5e90aa12a1ea65ed039674a9458a6f425
SHA256

896fa2c8e3228dcbbe5d52eaf4f22baf20fc084161378e8d02c120faaad7fd08
SHA512

1d9eb77f4bfa78abf845c0914df553902bc55b550a3b657f1a20e2fb395f79bc6e6b7a1f220aa04fb011fa966eafdb466f5566d2ac88fc4b0848443c88f560fa

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 2036	1604	rundll32.exe	28
PID 1604 wrote to memory of 2036	1604	rundll32.exe	28
PID 1604 wrote to memory of 2036	1604	rundll32.exe	28
PID 1604 wrote to memory of 2036	1604	rundll32.exe	28
PID 1604 wrote to memory of 2036	1604	rundll32.exe	28
PID 1604 wrote to memory of 2036	1604	rundll32.exe	28
PID 1604 wrote to memory of 2036	1604	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\es\TNrgyModbusServer.resources.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\es\TNrgyModbusServer.resources.dll,#1
  2⤵
  PID:2036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads