8daf2a0088faa54e2c2720af17559507bc68e318b080176895bdcb22edf01d5c | Triage

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20/02/2024, 09:07

Sharing

Report Analysis Logs

General

Target

masScan_1.6/Packet.dll
Size

94KB
MD5

1250bef11bfa086f772cd2a273bc036e
SHA1

bfb60b4072f4533d8497f3d90631f818e345bcc6
SHA256

6b19cffaa2bf4359be1a0130a1fb47ab45e8c3be5d0cb7986579c5e04e1d77a5
SHA512

76cbc346468d400c4e6a95b3c91abfec0a63a375aade6f47c70a3b3db76c513bcfd91ed2994059a6c8bdd6b266f9b17ecf11f9941481c7a2692925d2457f5bba
SSDEEP

1536:6wG9plhvRIRVC2wJAyPFCnPKc0z70yIKtIn8zVpWj:E9rjh5t9cZyIKtInb

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 1708	2172	rundll32.exe	28
PID 2172 wrote to memory of 1708	2172	rundll32.exe	28
PID 2172 wrote to memory of 1708	2172	rundll32.exe	28
PID 2172 wrote to memory of 1708	2172	rundll32.exe	28
PID 2172 wrote to memory of 1708	2172	rundll32.exe	28
PID 2172 wrote to memory of 1708	2172	rundll32.exe	28
PID 2172 wrote to memory of 1708	2172	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\masScan_1.6\Packet.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\masScan_1.6\Packet.dll,#1
  2⤵
  PID:1708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads