0a028766093d0b322eaf803dc600e0e7a9cb303208559b25764f26d6ed897bb6 | Triage

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 08:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

147415543/BIN/BOM.dll
Size

603KB
MD5

cb2b6ec9ce0ae4ff17b2519d4885b625
SHA1

ee6758532761e29f87530aac5a8c903b7f84f825
SHA256

b301b5975bcc55c2f8b07738cdd7a3d41b69ff6d2d9a92c9f8110985a85bae75
SHA512

42a5880d3f041d68563a645dc2f2ae95ac5a5adcc056ef553aa1bc51bb6d6596d6d56c20aa853fb468ced516c092660ef092c0e0c9f4ec7e0dc07626452acff1
SSDEEP

12288:0jxAW27iZv+xnKFmShZ7fvnHX18yJeBrpJhJ85UoYv:CsmiKFvZvCyKJhJ85U

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 1736	2840	rundll32.exe	28
PID 2840 wrote to memory of 1736	2840	rundll32.exe	28
PID 2840 wrote to memory of 1736	2840	rundll32.exe	28
PID 2840 wrote to memory of 1736	2840	rundll32.exe	28
PID 2840 wrote to memory of 1736	2840	rundll32.exe	28
PID 2840 wrote to memory of 1736	2840	rundll32.exe	28
PID 2840 wrote to memory of 1736	2840	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\147415543\BIN\BOM.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\147415543\BIN\BOM.dll,#1
  2⤵
  PID:1736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads