d72702999c526afaf6f6341889d5a21dd02595c6108e040b8d8f75a03d4c5f5a | Triage

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 17:21

Sharing

Report Analysis Logs

General

Target

$APPDATA/mIRC/bin/dll/popups.dll
Size

22KB
MD5

485a3aebd984b1460cb27bdd97ddac88
SHA1

51b4759bc501990128a42caf36a4d605f3716d54
SHA256

d2cde8cba35b287132b15da8ef2cac543fd539858eeeaafcd8e4042bb9539b90
SHA512

9f550284c083a64226a56a04d90615d3ef0756aa2f2ea826081a39523973eb988639f9797d92c70e8054a06f198da468648e2139f49b345700678921535febd6
SSDEEP

384:EHmJ8BDEDdNfWgnHNWr563lXSiPz1wTu1+rZrwr:E1wbjcr563li8Sfr+r

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2232	1704	rundll32.exe	28
PID 1704 wrote to memory of 2232	1704	rundll32.exe	28
PID 1704 wrote to memory of 2232	1704	rundll32.exe	28
PID 1704 wrote to memory of 2232	1704	rundll32.exe	28
PID 1704 wrote to memory of 2232	1704	rundll32.exe	28
PID 1704 wrote to memory of 2232	1704	rundll32.exe	28
PID 1704 wrote to memory of 2232	1704	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\mIRC\bin\dll\popups.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\mIRC\bin\dll\popups.dll,#1
  2⤵
  PID:2232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads