a815471df3a9d9700c63fecc246ae7f024288dbf7231937fb53a860064265479 | Triage

Analysis

max time kernel
3s
max time network
36s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03-02-2024 21:37

Sharing

Report Analysis Logs

General

Target

IDA-Pro-7.7-main/python38/_queue.dll
Size

28KB
MD5

dd146e2fa08302496b15118bf47703cf
SHA1

d06813e2fcb30cbb00bb3893f30c2661686cf4b7
SHA256

67e4e888559ea2c62ff267b58d7a7e95c2ec361703b5aa232aa8b2a1f96a2051
SHA512

5b93a782c9562370fc5b3f289ca422b4d1a1c532e81bd6c95a0063f2e3889ecf828003e42b674439fc7cd0fa72f64ad607bab6910abe9d959a4fb9fb08df263c
SSDEEP

768:UbErqQu06rhuOUrRm4MH5IImUVDG4yaC97hP:wuqXhuOC84a5IImUfydL

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 1972	1148	rundll32.exe	28
PID 1148 wrote to memory of 1972	1148	rundll32.exe	28
PID 1148 wrote to memory of 1972	1148	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\IDA-Pro-7.7-main\python38\_queue.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1148 -s 108
  2⤵
  PID:1972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads