67001c8f5a37c1ccd2d1750f21e28d372a8639c330aafbae111a5956c942b71a | Triage

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-03-2024 09:30

Sharing

Report Analysis Logs

General

Target

driver/w2K/driver/mv2.dll
Size

11KB
MD5

0823ee54e6ff2b3739a0a7275d73f762
SHA1

871adb6f992d155dbb1fc26f721ca89314740058
SHA256

5c31575919b0cdc1030a23cfa67460f9d03e8c5cef1cf584121c4658cbd4f93e
SHA512

b53600bf3fa9c544735e498b712be06ad065058e603adbdc78482279d681d57dc66c7f91d8b7186ffd3a3f28bf0eb195ad38db6816be5a88db5199c006774691
SSDEEP

192:Ipp7LIMu8j+d8VeuKsMNfzg54X8jSJUbueqNMHO:Wp018j+dEaNE54XdUb+OHO

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 2816	2804	rundll32.exe	28
PID 2804 wrote to memory of 2816	2804	rundll32.exe	28
PID 2804 wrote to memory of 2816	2804	rundll32.exe	28
PID 2804 wrote to memory of 2816	2804	rundll32.exe	28
PID 2804 wrote to memory of 2816	2804	rundll32.exe	28
PID 2804 wrote to memory of 2816	2804	rundll32.exe	28
PID 2804 wrote to memory of 2816	2804	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\driver\w2K\driver\mv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\driver\w2K\driver\mv2.dll,#1
  2⤵
  PID:2816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads