fed683f212b58345f6196f41ba17fb4663666ed6e8cb77ee99131764e0a4f668 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 03:09

Sharing

Report Analysis Logs

General

Target

Sasality.swin/Fatality.dll
Size

2.9MB
MD5

e7c2874178df4549c3f7b4ddb75b8aaa
SHA1

0e7c7d9a0d23d60028de6f59a67079c846b14fc7
SHA256

c5eb6001dadfc3316ceda2c805c6b146730ff00db5f3509720d46b0e2799890e
SHA512

17f57c2802a22039147908c89886144f6b1ab05ce455e2e8cb12cee69bc564b7de17f1e58bc50eaca667245db07d39f62b39c72ddcd6ab54fed0dddb03ca7d51
SSDEEP

49152:jf4XMh932FULAE/xuMWaPFkpI7D0C2LyY:juMhYFUt/vUGw

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2520	2008	rundll32.exe	28
PID 2008 wrote to memory of 2520	2008	rundll32.exe	28
PID 2008 wrote to memory of 2520	2008	rundll32.exe	28
PID 2008 wrote to memory of 2520	2008	rundll32.exe	28
PID 2008 wrote to memory of 2520	2008	rundll32.exe	28
PID 2008 wrote to memory of 2520	2008	rundll32.exe	28
PID 2008 wrote to memory of 2520	2008	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Sasality.swin\Fatality.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Sasality.swin\Fatality.dll,#1
  2⤵
  PID:2520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2520-0-0x0000000002140000-0x0000000002640000-memory.dmp

Filesize
5.0MB

Download