478e5a10a2d3f41fd903448dd9d06c7d901a53933cfa7d90f10d905d01c8fb49 | Triage

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 05:13

Sharing

Report Analysis Logs

General

Target

$0/wyeke.dll
Size

584KB
MD5

8d72049838c972e95f059074964caef3
SHA1

d3c6fe1e7fde339e20fad30dd442381355d9c864
SHA256

8cccccba3915668213fd73ec202a291ad8eb9920e7bc01e876ec7584e6302f8b
SHA512

a2213bb7e0c1f7aa3bf901b191b2408019d6a43213438b159c7548562d160358a12f7c218054fb441a61f01c60e657165702ab0245b741965949e272a558ed82
SSDEEP

12288:nEG5JNaYqvQ96roOMcIga0TqOV4FIV5EJa0ZyowlE5ZsarNp:n7I3vpMoa0Tq10Ds1r1N

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 2200	1696	rundll32.exe	28
PID 1696 wrote to memory of 2200	1696	rundll32.exe	28
PID 1696 wrote to memory of 2200	1696	rundll32.exe	28
PID 1696 wrote to memory of 2200	1696	rundll32.exe	28
PID 1696 wrote to memory of 2200	1696	rundll32.exe	28
PID 1696 wrote to memory of 2200	1696	rundll32.exe	28
PID 1696 wrote to memory of 2200	1696	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$0\wyeke.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$0\wyeke.dll,#1
  2⤵
  PID:2200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2200-0-0x0000000000280000-0x0000000000304000-memory.dmp

Filesize
528KB

Download