2cee2d93aa2c8c207d4f75dac4af89cbc88eb503562a346153593d31929d4f97 | Triage

Analysis

max time kernel
1558s
max time network
1558s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 06:59

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/SpiderBanner.dll
Size

9KB
MD5

17309e33b596ba3a5693b4d3e85cf8d7
SHA1

7d361836cf53df42021c7f2b148aec9458818c01
SHA256

996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
SHA512

1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
SSDEEP

192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 1676	2268	rundll32.exe	5
PID 2268 wrote to memory of 1676	2268	rundll32.exe	5
PID 2268 wrote to memory of 1676	2268	rundll32.exe	5
PID 2268 wrote to memory of 1676	2268	rundll32.exe	5
PID 2268 wrote to memory of 1676	2268	rundll32.exe	5
PID 2268 wrote to memory of 1676	2268	rundll32.exe	5
PID 2268 wrote to memory of 1676	2268	rundll32.exe	5

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SpiderBanner.dll,#1
  2⤵
  PID:1676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads