909df004857e854a646328179d73a9738eec6b2eb559be3b0cd8d3c53b3dd29a | Triage

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 05:06

Sharing

Report Analysis Logs

General

Target

Fix/360Verify.dll
Size

93KB
MD5

a8b29ba422db955c546580cf1207e75f
SHA1

261f5be755b1d18a42d0b18543dd01d731a661e9
SHA256

17b52b86c733e14ce7aeb40fdad9c123043abc37e0671111fd4f2bc4b5a5d089
SHA512

efbb2186d7d98013a5b50331e98e0104900676edae67cf0b44dbc80a400d62953fa6d8d95bd1175d7503113a91e503a49931b479ddeaf55657b8c4e087c920f8
SSDEEP

1536:I7XTU9u6hlfpKi0WLiT0F705JnG0J2htn2o2lfbe/n403:IPUI6hFnfaGR2o2lD2nD3

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 3012	3032	rundll32.exe	28
PID 3032 wrote to memory of 3012	3032	rundll32.exe	28
PID 3032 wrote to memory of 3012	3032	rundll32.exe	28
PID 3032 wrote to memory of 3012	3032	rundll32.exe	28
PID 3032 wrote to memory of 3012	3032	rundll32.exe	28
PID 3032 wrote to memory of 3012	3032	rundll32.exe	28
PID 3032 wrote to memory of 3012	3032	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Fix\360Verify.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Fix\360Verify.dll,#1
  2⤵
  PID:3012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads