87ea69570136c63736d95fd3950e11c67fd37ab1053410bc9e4aca66805a4cd9 | Triage

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-03-2024 22:43

Sharing

Report Analysis Logs

General

Target

Geode.dll
Size

6.8MB
MD5

7502d8873ce70ddd59e348c29183ed85
SHA1

ac5df33b02c299b3880e4d71cde8f5b21361c3a7
SHA256

67ba23a77ab8cdbb240775185394263e2a0c4b0fe88d9dad9f3837ca6c382c39
SHA512

dd18cc1bd423c73dffbff8126c3a1b24bc882ac9b34fa275128a9ba4fecb22014efbe6c0998268b638bd0ed3928377faef426bce25815042d37659318e6091bc
SSDEEP

49152:K+RiFPY39QoGR/HUYD+eXoKWwvlKg5RYfqBrSQ0FXrs8VOW:vR3NGR/0GX3vlKfql0Vrs8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2804 wrote to memory of 2716	2804	rundll32.exe	rundll32.exe
PID 2804 wrote to memory of 2716	2804	rundll32.exe	rundll32.exe
PID 2804 wrote to memory of 2716	2804	rundll32.exe	rundll32.exe
PID 2804 wrote to memory of 2716	2804	rundll32.exe	rundll32.exe
PID 2804 wrote to memory of 2716	2804	rundll32.exe	rundll32.exe
PID 2804 wrote to memory of 2716	2804	rundll32.exe	rundll32.exe
PID 2804 wrote to memory of 2716	2804	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Geode.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2804

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Geode.dll,#1
2⤵
PID:2716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads