9ff40de5a55aa6b5cf34c61acd52a26f77c6eb5cf1d464e0e651a046227a7b78 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18-02-2024 16:09

Sharing

Report Analysis Logs

General

Target

expatai.dll
Size

400KB
MD5

dd55071ced298687339566cbe9b23c40
SHA1

1b5f760daab97658f7c0f7c28db35f10bde761bb
SHA256

ed10a005bbab4385775e5964586bad0c1d267edbf87ce98feb3cc7135877cca1
SHA512

ae9753860775be0039463c408e080a2541465562702c2407b46d3ab15dacdae6721325eb60ae72e0b389da2524e6122593a6f9bf42f1c2df5c2cb8463c4026c8
SSDEEP

6144:0iKR+8NAOuiLSswqA5YcgU8IoIkfvvIsAOIjAOktasHaF:U+8TSpqA5Yo1kfvvIsqjM6F

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2896 wrote to memory of 2424	2896	rundll32.exe	rundll32.exe
PID 2896 wrote to memory of 2424	2896	rundll32.exe	rundll32.exe
PID 2896 wrote to memory of 2424	2896	rundll32.exe	rundll32.exe
PID 2896 wrote to memory of 2424	2896	rundll32.exe	rundll32.exe
PID 2896 wrote to memory of 2424	2896	rundll32.exe	rundll32.exe
PID 2896 wrote to memory of 2424	2896	rundll32.exe	rundll32.exe
PID 2896 wrote to memory of 2424	2896	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\expatai.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\expatai.dll,#1
  2⤵
  PID:2424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads