8d2f02a55a6957c8b8013d5df7837cbc836fa1e599d7d7eed4f1ef4a42f7fb8f | Triage

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 05:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

SnagIt 8/LTSCR12n.dll
Size

149KB
MD5

d299f5b13e5dcb0816bcfb250380b9e3
SHA1

3363e3bda9d71fa90fd0aaea366ebd4e1af02331
SHA256

7f9228d47d22c6b5af8dabfd84e467310869f6e55536b7785bf479eaf67b55ee
SHA512

ef3e449308dbbd89e8cb40cc6fe6b0a40498a385396e1e57b8483a4586d8d2cf098748166c3be760248d38d7177a1a6be15f3c4d9e4c983aa608ab132f80cf82
SSDEEP

3072://oJyRC0fRiia4y0r0mKaIj4A4DJVgt9kvPgE:YQrR7a4y0QmRIjb2g

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2732	2228	rundll32.exe	28
PID 2228 wrote to memory of 2732	2228	rundll32.exe	28
PID 2228 wrote to memory of 2732	2228	rundll32.exe	28
PID 2228 wrote to memory of 2732	2228	rundll32.exe	28
PID 2228 wrote to memory of 2732	2228	rundll32.exe	28
PID 2228 wrote to memory of 2732	2228	rundll32.exe	28
PID 2228 wrote to memory of 2732	2228	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SnagIt 8\LTSCR12n.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SnagIt 8\LTSCR12n.dll",#1
  2⤵
  PID:2732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads