9a33ff3deea984165327d7334e3cffa8df23aebcc1d1c0aa144044a52df35421 | Triage

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 09:52

Sharing

Report Analysis Logs

General

Target

appdata/plugins/weather/main.dll
Size

46KB
MD5

f8778f223c6676966b3c32850875fa08
SHA1

34bc813fd1ce85dcca704ab25560ae6fe330abf0
SHA256

b188663b86b3e8d6d7d7d133c401dde46912c8c25f40e6268cdcad539f469a50
SHA512

9063bf41adbf49f286e5f89ae581f6cd050fae3e6cc4e37d89437f5b7ad141a5ac27c887392abbc68b32f6f489ab3a52fddff41c20bd05180bcfe26c93036b74
SSDEEP

768:lo5Bffw4vesPm/cGilW8ZmV0V8X01ufooF+6JLD:kpKT/6W8ZmynIJLD

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 544	2792	rundll32.exe	28
PID 2792 wrote to memory of 544	2792	rundll32.exe	28
PID 2792 wrote to memory of 544	2792	rundll32.exe	28
PID 2792 wrote to memory of 544	2792	rundll32.exe	28
PID 2792 wrote to memory of 544	2792	rundll32.exe	28
PID 2792 wrote to memory of 544	2792	rundll32.exe	28
PID 2792 wrote to memory of 544	2792	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\appdata\plugins\weather\main.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\appdata\plugins\weather\main.dll,#1
  2⤵
  PID:544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads