177eb704df67eb4982a6f125fb2b57342e80db27f9bfeea8ff76d8e8ef318801 | Triage

Analysis

max time kernel
122s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20-02-2024 01:05

Sharing

Report Analysis Logs

General

Target

resources/binaries/index.dll
Size

3.0MB
MD5

73039ad2733a51291107af7597d6b690
SHA1

f4528cef20e32dce686b7d62bbcce149f8f278c4
SHA256

7ad5d3556e8be648b4935fbb2857fbecf96c83ded89010753663c08b9f536489
SHA512

e3ee8e58d5eabcd8b291ff97a472e730711b4bc0c69b291dbee249d6c9951b808d67d59c2f2ff560064c0ca83d9fcf47deb227c6e0126830b314993b60a9ce37
SSDEEP

49152:Enl2ywXj6yiRhYtSMNSVEXDZBSf4dUWC5P/y3n0XgWQjIJ4Ps:Ev0fy35Qn0XgWF4Ps

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2080	1968	rundll32.exe	27
PID 1968 wrote to memory of 2080	1968	rundll32.exe	27
PID 1968 wrote to memory of 2080	1968	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\binaries\index.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1968 -s 212
  2⤵
  PID:2080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads