f0595b6040ec289b66c7d9cf1303d6a9de37956cf3ed3b4ae0e38f7398d7afef | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 11:16

Sharing

Report Analysis Logs

General

Target

ASYCFILT.dll
Size

140KB
MD5

54b417a2223b30483367f113ca0d5f69
SHA1

a23c7c6e3426d4ad96cd1ee63fdf79d00594d36c
SHA256

7f9a1eff6520f84cefb9368964fde843fea3da3a98a00d6460c6356f7452371f
SHA512

222cd1a025efe3a91c030ae592971c683079153a8095d5feb27b9141a91115dadb0ad67372561b571a165c8af2fb885919a948a4ddc817adf4e72d931cce73a4
SSDEEP

3072:ItRHoJi+4IXU2qc4L37PCl7z7Z6fkrUCgpne:SHSi+4I3lczClvN6Dzn

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2348	2192	rundll32.exe	28
PID 2192 wrote to memory of 2348	2192	rundll32.exe	28
PID 2192 wrote to memory of 2348	2192	rundll32.exe	28
PID 2192 wrote to memory of 2348	2192	rundll32.exe	28
PID 2192 wrote to memory of 2348	2192	rundll32.exe	28
PID 2192 wrote to memory of 2348	2192	rundll32.exe	28
PID 2192 wrote to memory of 2348	2192	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ASYCFILT.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ASYCFILT.dll,#1
  2⤵
  PID:2348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads