26f577e37ae6ea65acf5f454c439fd7adcd0491380bdc683ae84d34e654ea9b9 | Triage

Analysis

max time kernel
118s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 01:14

Sharing

Report Analysis Logs

General

Target

FatOperate.dll
Size

129KB
MD5

e5047a2ad555976e241f5779e7b036de
SHA1

aa4a2c9a4740d31b460975f4c016737271963a14
SHA256

4ffe7afa365d65c8193ddd9543cae3d82008456107e5ccd78324f1a7ed7119a6
SHA512

d92b3d8ba3ac8fde66feff570fccecd18eb0b299c115ade3a8f6244ddba5a09df65ed11a40fe9b6a27325cc55bcd8809170bf4666829cd87ad44798c257a4651
SSDEEP

1536:hTg8mPw8d4SLbmRPt4Ntxn4tBTjzHS9rck5QyuIoaGsS5yBH:hU82gkbjLprzuIoaGsSoBH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2808	2624	rundll32.exe	21
PID 2624 wrote to memory of 2808	2624	rundll32.exe	21
PID 2624 wrote to memory of 2808	2624	rundll32.exe	21
PID 2624 wrote to memory of 2808	2624	rundll32.exe	21
PID 2624 wrote to memory of 2808	2624	rundll32.exe	21
PID 2624 wrote to memory of 2808	2624	rundll32.exe	21
PID 2624 wrote to memory of 2808	2624	rundll32.exe	21

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FatOperate.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\FatOperate.dll,#1
  2⤵
  PID:2808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2808-0-0x00000000000F0000-0x0000000000119000-memory.dmp

Filesize
164KB

Download
memory/2808-1-0x0000000000120000-0x0000000000136000-memory.dmp

Filesize
88KB

Download