b8cb661ff6b8dd7be850a9ac2594a6bec1ad468316a8254470ff062112b64910 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19-02-2024 22:11

Sharing

Report Analysis Logs

General

Target

XInput9_1_0.dll
Size

11KB
MD5

d61fd9bf10f59713082cfc9a3accbf87
SHA1

d36a0129c846be9bd2a79af82a5a9af199f84ed8
SHA256

0222e64dc51dc14095e453b46b485834b0c81ae8ced850e7e7b52acf11bb723e
SHA512

595e73710bb567fd8be0ac130aac6334ae34bddca3e39c34322c7390947152d15a8717d30a6e923c6d48390312f42501f29436d6c73be59ed086d26362921c3d
SSDEEP

192:TQdcdW6Ss9HI23vSdZXShyWJT/BEaE+EgwijOyKaCwmPgbDLTGc:f/SspI2WgHJZlj/Ka/tvi

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2380 wrote to memory of 2000	2380	rundll32.exe	rundll32.exe
PID 2380 wrote to memory of 2000	2380	rundll32.exe	rundll32.exe
PID 2380 wrote to memory of 2000	2380	rundll32.exe	rundll32.exe
PID 2380 wrote to memory of 2000	2380	rundll32.exe	rundll32.exe
PID 2380 wrote to memory of 2000	2380	rundll32.exe	rundll32.exe
PID 2380 wrote to memory of 2000	2380	rundll32.exe	rundll32.exe
PID 2380 wrote to memory of 2000	2380	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XInput9_1_0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2380

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XInput9_1_0.dll,#1
2⤵
PID:2000

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...