909df004857e854a646328179d73a9738eec6b2eb559be3b0cd8d3c53b3dd29a | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 05:06

Sharing

Report Analysis Logs

General

Target

Dyn/MtKiller.dll
Size

53KB
MD5

71a18d9f961c9db73f7ae4be8dba71f5
SHA1

58d5b7dca3b02b59d8ebf023d3eb9e50c4d14eb4
SHA256

02a1f0690a3ec9ca33c9295ca8130f6e03955169211ac4b1c67d37a888d03b0d
SHA512

c775fed65293a2adcec026ff30f5f33a0b3064a0930fb6d9c07924fc509815867e018ae11a7491a9524b2587b4890b0f6d91de4fb81c35a5227ed70c1dab278f
SSDEEP

768:4Gx0324Tk6fTJx8YBFMLv5VSbAixsxldqc9NEDbn4LZHw8:E24Tk67JJFK3WoldfEnn4S8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 2872	1756	rundll32.exe	28
PID 1756 wrote to memory of 2872	1756	rundll32.exe	28
PID 1756 wrote to memory of 2872	1756	rundll32.exe	28
PID 1756 wrote to memory of 2872	1756	rundll32.exe	28
PID 1756 wrote to memory of 2872	1756	rundll32.exe	28
PID 1756 wrote to memory of 2872	1756	rundll32.exe	28
PID 1756 wrote to memory of 2872	1756	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dyn\MtKiller.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dyn\MtKiller.dll,#1
  2⤵
  PID:2872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads