0a028766093d0b322eaf803dc600e0e7a9cb303208559b25764f26d6ed897bb6 | Triage

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-03-2024 08:47

Sharing

Report Analysis Logs

General

Target

147415543/Module/BAS.dll
Size

603KB
MD5

c7c89ca09fdfb4fda867b53f7c8dd876
SHA1

a015a9ebd164cf8b83ab7012a8002ff074c97f2d
SHA256

54bac3a016794e3730ef40d1e44f5f0e6e1ec61147a88cda49ab835a71c23dc3
SHA512

04cfbe1de6747178fab77a6f40c00868c3c897a15c29aaca7c752ba013bf8f9c3ab3d829c4f43e4aa2b35d5f5d7b99260de8f980eebd37cae115390e201ea063
SSDEEP

12288:0jxAC2H25v+hbeleShFLfvLD/1oWJKBnpJhJkeUk+9:CIWa6lHtv+WiJhJkeU

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 1792	848	rundll32.exe	27
PID 848 wrote to memory of 1792	848	rundll32.exe	27
PID 848 wrote to memory of 1792	848	rundll32.exe	27
PID 848 wrote to memory of 1792	848	rundll32.exe	27
PID 848 wrote to memory of 1792	848	rundll32.exe	27
PID 848 wrote to memory of 1792	848	rundll32.exe	27
PID 848 wrote to memory of 1792	848	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\147415543\Module\BAS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\147415543\Module\BAS.dll,#1
  2⤵
  PID:1792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1792-0-0x0000000000450000-0x00000000004EC000-memory.dmp

Filesize
624KB

Download