271de5aed87a398dedf889c16d7927e90f07facb4774a073cd4f365073fe51f8 | Triage

Analysis

max time kernel
120s
max time network
135s
platform
windows7_x64
resource
win7-20240221-it
resource tags

arch:x64arch:x86image:win7-20240221-itlocale:it-itos:windows7-x64systemwindows
submitted
05/03/2024, 14:02

Sharing

Report Analysis Logs

General

Target

libcef.dll
Size

113.1MB
MD5

925aca5d42569e5a20bdc2c0af93d1d0
SHA1

624fff9da08c6fb58fef773815aba1e1d6733e90
SHA256

a548e56f4f235f7b11ec1d3cd3db276f5d91843ec0f2847c5516194ce3e97724
SHA512

2e9cbe21d3511d760cf7c50675906c329a819df8db182066a09391b22166100ec09cf6010bdd8c5123c36694974e08acc705eb0c37485f6bf60c0c16bbde0a6d
SSDEEP

1572864:pJDYtDe6+JOlgEQNTHCPYmf7W5v8051LgovRUHb8tHjv50Ap16SzOVgRn:plYHoTiPsxHB3y

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 2624	2524	rundll32.exe	28
PID 2524 wrote to memory of 2624	2524	rundll32.exe	28
PID 2524 wrote to memory of 2624	2524	rundll32.exe	28
PID 2524 wrote to memory of 2624	2524	rundll32.exe	28
PID 2524 wrote to memory of 2624	2524	rundll32.exe	28
PID 2524 wrote to memory of 2624	2524	rundll32.exe	28
PID 2524 wrote to memory of 2624	2524	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libcef.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libcef.dll,#1
  2⤵
  PID:2624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads