c38f1fcf1a2d5b1cea2d24d47afdc38ca6b27e12436b94d038e0859fa07fd2b0 | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 05:11

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/SetupHelper.dll
Size

52KB
MD5

bcc0fc146ac5958fc16a2d43fdf3aaed
SHA1

a40ca7d638cab23a47a35386ef097372fdafeb21
SHA256

4d8072399ff0042a40e016de11fc762adea5b97399ebf800e7c60d3ea82be246
SHA512

0a363953a4b27956f6badf72d14204403bd68cb97f6189f1f384d08a284b3e460df25f5b3e23fb3bb54c6dc81428a1efbe089f6961e878bb13d208f1d9b06910
SSDEEP

768:moJnSlwCLny7KeW/H8wN+ewDHMiiQsW+ECMtX:vA7BfN+em5V+UX

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 1108	2964	rundll32.exe	28
PID 2964 wrote to memory of 1108	2964	rundll32.exe	28
PID 2964 wrote to memory of 1108	2964	rundll32.exe	28
PID 2964 wrote to memory of 1108	2964	rundll32.exe	28
PID 2964 wrote to memory of 1108	2964	rundll32.exe	28
PID 2964 wrote to memory of 1108	2964	rundll32.exe	28
PID 2964 wrote to memory of 1108	2964	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SetupHelper.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SetupHelper.dll,#1
  2⤵
  PID:1108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads