2e8bc88df755f2a3fe6639fe58bf8384cb939d13f7769a8ffb029d3b0665d07b | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 19:40

Sharing

Report Analysis Logs

General

Target

Plugs/TOPInterfaceU.dll
Size

675KB
MD5

2284f506421d894e35def3167603a77d
SHA1

2fd79c9872a6c4963b1d4f11e9b9bff3568aa39f
SHA256

94158a8e6bc94bb86f47fa6fdfa68cccf400f876182be9a7fb90aefb0ea92f7b
SHA512

a220566133b917b04c1ec21680db2a9f3037587066a8c5f135f7c7bcb4ee33c80ce6aaf3f50651d514a1cf7266bfaa2a3eaaca5b6a427aa5d18c29c3d45106db
SSDEEP

12288:CjTLKv9u4aqMQvP2EPRU0LyUkgo4IrefAIQjtYHnlLnlB:Cj2veEPRjJo4IrefhWcLnlB

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2164	2168	rundll32.exe	28
PID 2168 wrote to memory of 2164	2168	rundll32.exe	28
PID 2168 wrote to memory of 2164	2168	rundll32.exe	28
PID 2168 wrote to memory of 2164	2168	rundll32.exe	28
PID 2168 wrote to memory of 2164	2168	rundll32.exe	28
PID 2168 wrote to memory of 2164	2168	rundll32.exe	28
PID 2168 wrote to memory of 2164	2168	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugs\TOPInterfaceU.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugs\TOPInterfaceU.dll,#1
  2⤵
  PID:2164

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads