2e8bc88df755f2a3fe6639fe58bf8384cb939d13f7769a8ffb029d3b0665d07b | Triage

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 19:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

gtJpeg.dll
Size

156KB
MD5

5a4e6c970699f92c51a4251e7ee2ed1f
SHA1

9d597b0e16882f7858d4b38d76af14b2feca9300
SHA256

f5efdaf3f238d4bf837d85132479f0afa9110795500900fc26fd9424fc5b2b0b
SHA512

bfa553434394bf11ca3906a4fd3d5aac94caab5392ed7986ac72857aa673563bd76b5caff63a59b028baa057e78e7a07819b3d816dfc11b5b28ec2ddc7b9ef06
SSDEEP

3072:CEod5egaj2bej9yUPRtnyWuY5uitQCGwxlzVNC:CEUegEBRtyNeQjwV

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2168	1680	rundll32.exe	28
PID 1680 wrote to memory of 2168	1680	rundll32.exe	28
PID 1680 wrote to memory of 2168	1680	rundll32.exe	28
PID 1680 wrote to memory of 2168	1680	rundll32.exe	28
PID 1680 wrote to memory of 2168	1680	rundll32.exe	28
PID 1680 wrote to memory of 2168	1680	rundll32.exe	28
PID 1680 wrote to memory of 2168	1680	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gtJpeg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\gtJpeg.dll,#1
  2⤵
  PID:2168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads