a04acef29fbfd30b1b63dc6c69717506e2f95d01565b0fba9d33754b9886f459 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
09-03-2024 23:12

Sharing

Report Analysis Logs

General

Target

vp3pl.dll
Size

63KB
MD5

648f604f4c0430787f36f3b65f36f60e
SHA1

aaf42e82f53fb656710a72ae27ba87f4218b09fa
SHA256

94b97e1d81965e30a1949d39217630a2592929274dffc7260fc8bc9b1b1f7dda
SHA512

a66417c173982573030905352560a8da6204c3e3887266cb09cc01c88167cd33ec27fe73ff5e5c8dffc3334745e94c3a26dfbe734fa250dc0f908cd94bd59cd1
SSDEEP

768:hATmq+Q6vwHC6r+8Y8ITRXXG9LLPH0E5Ww2bHE5v4jtCDscx88e5pWghug3n8z95:smq+QJlLmW5KQX65pWJgAfx

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2460	2784	rundll32.exe	28
PID 2784 wrote to memory of 2460	2784	rundll32.exe	28
PID 2784 wrote to memory of 2460	2784	rundll32.exe	28
PID 2784 wrote to memory of 2460	2784	rundll32.exe	28
PID 2784 wrote to memory of 2460	2784	rundll32.exe	28
PID 2784 wrote to memory of 2460	2784	rundll32.exe	28
PID 2784 wrote to memory of 2460	2784	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vp3pl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\vp3pl.dll,#1
  2⤵
  PID:2460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads