cf80595f17a3873f83e9ddaa22683fdee557a1f5243822489f87f3bd6938250a | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10-02-2024 02:12

Sharing

Report Analysis Logs

General

Target

Geode.dll
Size

6.1MB
MD5

4b37533ceb9c5d732cc21a80389f16eb
SHA1

78d5f802dd22602b5a4a6a65ce60f742501c1e57
SHA256

c886df9524033f5e42c33ce9832baebf45986eb7c93023e72436bbb247cea1de
SHA512

4c67a34a8d80e39444efec68b782f314b442fe19be1db0b034529dea2ae2b5e786ff6f062b7be3fa4ae5299a169c648b8a56c82001b125e0741fabfb2128f43c
SSDEEP

98304:WNI80VZni7n05qZnNvSH0zqle/rnGv0Kqlq2QqOCJqqqq8Tql4q8Tqqy:WNI80Pm0IXK0X

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2480 wrote to memory of 312	2480	rundll32.exe	rundll32.exe
PID 2480 wrote to memory of 312	2480	rundll32.exe	rundll32.exe
PID 2480 wrote to memory of 312	2480	rundll32.exe	rundll32.exe
PID 2480 wrote to memory of 312	2480	rundll32.exe	rundll32.exe
PID 2480 wrote to memory of 312	2480	rundll32.exe	rundll32.exe
PID 2480 wrote to memory of 312	2480	rundll32.exe	rundll32.exe
PID 2480 wrote to memory of 312	2480	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Geode.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2480

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Geode.dll,#1
2⤵
PID:312

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...