a519b9d032a342985bfe1fa3f1244f1db6699805d7883139a8245eba1c2e5dab | Triage

Analysis

max time kernel
47s
max time network
16s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-03-2024 16:03

Sharing

Report Analysis Logs

General

Target

9923.dll
Size

840KB
MD5

f6da6e194c429fe815f7d592688f3009
SHA1

6df03d98320c3877567a05efa94c52f828269e21
SHA256

28d318a64d06bd5c86c11002be6805ebd114600b2f1e28f136924668b915e77b
SHA512

20e73161b2615b207c1c61360db9283cb9aec8a1295ce03f1b34976a13ba3b6e992337ac6e39d51789eadeec8d7db322abc494e667f4f9f2c3f3a3642c9fd91c
SSDEEP

24576:ee9nfmpSVmL+Cf72yb1SFEtEfPmY4uRD7HpUMhOw8ghE:dBmpSVmLfCDfPJ4cDFPhmghE

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1712	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 1712	2176	rundll32.exe	28
PID 2176 wrote to memory of 1712	2176	rundll32.exe	28
PID 2176 wrote to memory of 1712	2176	rundll32.exe	28
PID 2176 wrote to memory of 1712	2176	rundll32.exe	28
PID 2176 wrote to memory of 1712	2176	rundll32.exe	28
PID 2176 wrote to memory of 1712	2176	rundll32.exe	28
PID 2176 wrote to memory of 1712	2176	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9923.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9923.dll,#1
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1712-0-0x00000000002A0000-0x00000000002D6000-memory.dmp

Filesize
216KB

Download
memory/1712-1-0x00000000002A0000-0x00000000002D6000-memory.dmp

Filesize
216KB

Download