5341b3921b75549adbe59365517c30bd045e63162728d9ba48f79832fea1bea0 | Triage

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-01-2024 17:21

Sharing

Report Analysis Logs

General

Target

ConnectifyNAT.dll
Size

288KB
MD5

d1e979c80f3a75fdab05462dad383bc3
SHA1

e8ef2c8fe5b45888020dce862dd4c7ae59c0be20
SHA256

9bfaa78a288f894ead9bbe616b24c777c5da76ffbc9ed03aa3d8e4a3c954ffe7
SHA512

ff2a2970988b7abf4563b94908a355d49720e993750807ee64b7f0439c0f1dfdf6aa0cea5323594ecf3f8094698408f02d665118b1c8710643afecf61f258a65
SSDEEP

6144:Tj9PE42T+v4PlM+IsRb+q1jrdVrNGZam0Z4Ocy:piaq1j9o90Zlp

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2108 wrote to memory of 3052	2108	rundll32.exe	rundll32.exe
PID 2108 wrote to memory of 3052	2108	rundll32.exe	rundll32.exe
PID 2108 wrote to memory of 3052	2108	rundll32.exe	rundll32.exe
PID 2108 wrote to memory of 3052	2108	rundll32.exe	rundll32.exe
PID 2108 wrote to memory of 3052	2108	rundll32.exe	rundll32.exe
PID 2108 wrote to memory of 3052	2108	rundll32.exe	rundll32.exe
PID 2108 wrote to memory of 3052	2108	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ConnectifyNAT.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2108

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ConnectifyNAT.dll,#1
2⤵
PID:3052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3052-0-0x0000000001FE0000-0x0000000002187000-memory.dmp

Filesize
1.7MB

Download