8d2f02a55a6957c8b8013d5df7837cbc836fa1e599d7d7eed4f1ef4a42f7fb8f | Triage

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-03-2024 05:17

Sharing

Report Analysis Logs

General

Target

SnagIt 8/Lfpct12n.dll
Size

59KB
MD5

2658a41fb17b7dcdb0d3122b9ca26fcc
SHA1

3333dfb0148476b3f937247985c3239c3894e5cb
SHA256

c3c66ed07a0ca3b05781b6b4e2e6fdd2cdbd2c732005cd60d2deb40c0d29cced
SHA512

9afd556d5eedef868aa540b1ff905fdb64e7a83c8d8abfa8b8066ab13905f4511ad751742ffb0440ac68e5aa6a41ab5f9492b00a6de23557f72e0aadc2e89378
SSDEEP

1536:PNSYxF9hu3SIPHGG666sTL/Uvvw+4kq8g2:PNVHXIPHn666sTL/UnRE8g2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 2772	2492	rundll32.exe	28
PID 2492 wrote to memory of 2772	2492	rundll32.exe	28
PID 2492 wrote to memory of 2772	2492	rundll32.exe	28
PID 2492 wrote to memory of 2772	2492	rundll32.exe	28
PID 2492 wrote to memory of 2772	2492	rundll32.exe	28
PID 2492 wrote to memory of 2772	2492	rundll32.exe	28
PID 2492 wrote to memory of 2772	2492	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SnagIt 8\Lfpct12n.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SnagIt 8\Lfpct12n.dll",#1
  2⤵
  PID:2772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads