e2735c9c408eb63b77355359f71235f0c473f2eac14f9498c58e11e109b35d60 | Triage

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 06:36

Sharing

Report Analysis Logs

General

Target

krnln.dll
Size

1.1MB
MD5

638e737b2293cf7b1f14c0b4fb1f3289
SHA1

f8e2223348433b992a8c42c4a7a9fb4b5c1158bc
SHA256

baad4798c3ab24dec8f0ac3cde48e2fee2e2dffa60d2b2497cd295cd6319fd5b
SHA512

4d714a0980238c49af10376ff26ec9e6415e7057925b32ec1c24780c3671047ac5b5670e46c1c6cf9f160519be8f37e1e57f05c30c6c4bda3b275b143aa0bf12
SSDEEP

12288:gRZTEr9vWWBjekIPNSohrqbTkjd67pStJgkyOPNMfvsnIPb1m:vJvWmeP5rqnkwpiJxyOPNMnrb1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2316	2180	rundll32.exe	28
PID 2180 wrote to memory of 2316	2180	rundll32.exe	28
PID 2180 wrote to memory of 2316	2180	rundll32.exe	28
PID 2180 wrote to memory of 2316	2180	rundll32.exe	28
PID 2180 wrote to memory of 2316	2180	rundll32.exe	28
PID 2180 wrote to memory of 2316	2180	rundll32.exe	28
PID 2180 wrote to memory of 2316	2180	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\krnln.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\krnln.dll,#1
  2⤵
  PID:2316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads