f59b9ff344d986ea37b2af26bd6bdf4bba7d004b0f6efd82cfb050dc8b2e94ef | Triage

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 10:54

Sharing

Report Analysis Logs

General

Target

Plugins/gen_tray.dll
Size

11KB
MD5

5c26d579f14f0c197f20b81b1402669d
SHA1

5c5c619887cd7d72ccc195f84a491e29108a0957
SHA256

46e5e18537127319d3b0569ddda7f8c32bae437a711c8372f4ef4240aff0fac4
SHA512

a6bc5922d581a1779a760c2d26fa9c944157652cb28598720d43e89486ef79376cdc7d1017371b47bb7bbc63de925c762980f8b72cd7288b49f2d7c9519807a5
SSDEEP

96:vcSFxDdlzrrMfxPUpqU9OMdbQRbsJ/qMPbJeZ+KUv:0SvrgfxPIp9OM9Q5U/qMPbJeZ+j

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 1948	2404	rundll32.exe	28
PID 2404 wrote to memory of 1948	2404	rundll32.exe	28
PID 2404 wrote to memory of 1948	2404	rundll32.exe	28
PID 2404 wrote to memory of 1948	2404	rundll32.exe	28
PID 2404 wrote to memory of 1948	2404	rundll32.exe	28
PID 2404 wrote to memory of 1948	2404	rundll32.exe	28
PID 2404 wrote to memory of 1948	2404	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\gen_tray.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\gen_tray.dll,#1
  2⤵
  PID:1948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads