909df004857e854a646328179d73a9738eec6b2eb559be3b0cd8d3c53b3dd29a | Triage

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 05:06

Sharing

Report Analysis Logs

General

Target

Dyn/DllJmpKiller.dll
Size

53KB
MD5

05ee82899ddfbc549699bbb50a654b47
SHA1

49e5a506bc42470d37ef4bddf7d69ed05571875a
SHA256

ea1d741a8ac90c4ec23a7836c3da06648485575457642f963cd2ebe57c5faf8e
SHA512

2e1d793787808ff8da49151dc37472af9d7538f1b30ff1431774dfbdc76596476f6eeed8bccf7d041ee74b04f950c6e126631f98360758fce942202525bbf260
SSDEEP

768:gJjWTJrhPcZ/WFpAdzCbzHs+FjhDl6Dzj/n4LZm:uWTJrBquQzCPHR7l6Dz7n44

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2892	1708	rundll32.exe	28
PID 1708 wrote to memory of 2892	1708	rundll32.exe	28
PID 1708 wrote to memory of 2892	1708	rundll32.exe	28
PID 1708 wrote to memory of 2892	1708	rundll32.exe	28
PID 1708 wrote to memory of 2892	1708	rundll32.exe	28
PID 1708 wrote to memory of 2892	1708	rundll32.exe	28
PID 1708 wrote to memory of 2892	1708	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dyn\DllJmpKiller.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dyn\DllJmpKiller.dll,#1
  2⤵
  PID:2892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads