b9973ba3407e32e942f5873c609b4552ce787e79df192f6588292f23080e08b8 | Triage

Analysis

max time kernel
47s
max time network
16s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
05-03-2024 13:14

Sharing

Report Analysis Logs

General

Target

mc chet/Project4.dll
Size

123KB
MD5

8c3828ff057a9b0cbe1796c0059c19bc
SHA1

f04fc763b2ad00334f5e98dc68484be7a920f5f4
SHA256

f1f1bdbdc9f206d262d067869bee7bed0b467281906c55ec3cc3298808697d89
SHA512

443c2b75e90c9055b9f8fb17bb8fec01befbe031bbd89e81bc7c0e376af38a1d6c91f2bdf3d7815397d3b21ecc7591120a25c457cefe97abcd3384a6dcc102c2
SSDEEP

3072:Jj/+pGsDnRrE6Nvc9Vno0KAa7sUv+EXUJ/XffL:J6brE669dO789vfL

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2784	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2784	2000	rundll32.exe	28
PID 2000 wrote to memory of 2784	2000	rundll32.exe	28
PID 2000 wrote to memory of 2784	2000	rundll32.exe	28
PID 2000 wrote to memory of 2784	2000	rundll32.exe	28
PID 2000 wrote to memory of 2784	2000	rundll32.exe	28
PID 2000 wrote to memory of 2784	2000	rundll32.exe	28
PID 2000 wrote to memory of 2784	2000	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\mc chet\Project4.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\mc chet\Project4.dll",#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2784-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download