0a028766093d0b322eaf803dc600e0e7a9cb303208559b25764f26d6ed897bb6 | Triage

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-03-2024 08:47

Sharing

Report Analysis Logs

General

Target

147415543/BIN/PMC.dll
Size

252KB
MD5

5caf1d49ac8d91b41255958c7dd1c357
SHA1

52f6acf6f1329266e8d6fffd25b168aba63fd1bb
SHA256

37040b9d7e3e052242d00454802f9171a9bfd68e572d1006da1aa63cc06d6a89
SHA512

0dfba5c6557a36a095230cb5c0ffac1f106782ca522e8ec65f8fb307511200de9a176ffbbb8b16a851bd55cc0c597c3e316fc1d28bddb400909e9bd806601746
SSDEEP

6144:keJyGiyxm9CzFjaOTRl8o97W6j4kGoWt9B0:ts7yxm9+tfTn8er43o

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 2684	2680	rundll32.exe	28
PID 2680 wrote to memory of 2684	2680	rundll32.exe	28
PID 2680 wrote to memory of 2684	2680	rundll32.exe	28
PID 2680 wrote to memory of 2684	2680	rundll32.exe	28
PID 2680 wrote to memory of 2684	2680	rundll32.exe	28
PID 2680 wrote to memory of 2684	2680	rundll32.exe	28
PID 2680 wrote to memory of 2684	2680	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\147415543\BIN\PMC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\147415543\BIN\PMC.dll,#1
  2⤵
  PID:2684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads