a3c3f7a0014e41ff435db5b87ec92e60ada72a94fc401cb1ef3cf6daf71630e1 | Triage

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 20:56

Sharing

Report Analysis Logs

General

Target

Packet.dll
Size

201KB
MD5

5fc00659d63dc1f6d3ea47ad282ff3d2
SHA1

cf1c989875a1a98c3ff4af0b469ee863636d1f06
SHA256

3dec61995d23d603224c67c41a1f49fe39d9c7c174a92a387bc5507a3ceba863
SHA512

8a00bdd0730a1922c9d29f4a202592c4088798dd767c927ce50b8625c71afb0f3e350e0a6f8d880fb6900f2ff6c9ad8134d8e352cdda97915be4ff28c0778d33
SSDEEP

3072:9vLYEEJS6OMZSMlNwf8dGUzgY6DU1zleTfUM8dvcImWbFTAA:90isZxlG+GU6KAUPF

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2488	2180	rundll32.exe	28
PID 2180 wrote to memory of 2488	2180	rundll32.exe	28
PID 2180 wrote to memory of 2488	2180	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Packet.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2180 -s 128
  2⤵
  PID:2488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads