2e8bc88df755f2a3fe6639fe58bf8384cb939d13f7769a8ffb029d3b0665d07b | Triage

Analysis

max time kernel
82s
max time network
42s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 19:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

xWeb.dll
Size

140KB
MD5

c2bfb25fa2173fdbccde89e4b62a52f1
SHA1

d08285f79b19c7b44bd1a57399af3518ae1ebc2f
SHA256

b01d659f8361afd3545ccd6a828193695c7b749f0180b4e86244600054cefc76
SHA512

cfa2a28697b82675e06957b750a8fbacfef12503f45226080af8215acea2ac1474d525ec8dec7c6cc0fbe91b8c8a93250324ace3ef6c2898af22e3664497a920
SSDEEP

1536:1vcMmZf5xfp5Rci9bJxToinlVPdTqofzaKjvHvMytY6tlSxHxRIK:1ufTSaRlV5fvdLlSxbh

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2520	2368	rundll32.exe	29
PID 2368 wrote to memory of 2520	2368	rundll32.exe	29
PID 2368 wrote to memory of 2520	2368	rundll32.exe	29
PID 2368 wrote to memory of 2520	2368	rundll32.exe	29
PID 2368 wrote to memory of 2520	2368	rundll32.exe	29
PID 2368 wrote to memory of 2520	2368	rundll32.exe	29
PID 2368 wrote to memory of 2520	2368	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\xWeb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\xWeb.dll,#1
  2⤵
  PID:2520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads