33a1c7f4799b940d2a1e9766e4b37cb298f40377982ac4773443dd500aaf085e | Triage

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-02-2024 16:59

Sharing

Report Analysis Logs

General

Target

MSSETUP.dll
Size

276KB
MD5

2b1d27a3b504de769a3c0c4c582fc9ad
SHA1

3d2b651d2e2386f4ffe1d418165611ba165ca1e6
SHA256

61d84dd065a4e1be2c491a8c435d0f17a0d9708d9af8d59bfb7c3c3cb6a6154a
SHA512

8bd738586903df032e40b4b3e3dac3634f5d851efe01def53ca5e16c46609442f68bcd4f5ba073a9e1925e8bd0e50e5bb3bb0ca6d886de429a0993bc9a5e0ad4
SSDEEP

6144:sXz52XinuTJuS7KSg0KkNSXXCy7VxdDfXBt:SF2Xiu9uCxpKkNUjDfB

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2956	3036	rundll32.exe	28
PID 3036 wrote to memory of 2956	3036	rundll32.exe	28
PID 3036 wrote to memory of 2956	3036	rundll32.exe	28
PID 3036 wrote to memory of 2956	3036	rundll32.exe	28
PID 3036 wrote to memory of 2956	3036	rundll32.exe	28
PID 3036 wrote to memory of 2956	3036	rundll32.exe	28
PID 3036 wrote to memory of 2956	3036	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MSSETUP.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MSSETUP.dll,#1
  2⤵
  PID:2956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads