3f9b4dca68a3211b84335bea3dea651cc6ae2b3fcfaaca057debac69f4223f69 | Triage

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/03/2024, 00:49

Sharing

Report Analysis Logs

General

Target

bass.dll
Size

95KB
MD5

85ab9b561224a0e4dbbf8f210b6052fa
SHA1

ff6487a2fdb2d8811d600c9c0a7eaaf8d33a595e
SHA256

1670e07e8e26feb3a2d831c43ea92a9d3a74e075ad90e45b5fa953b738804834
SHA512

e222eff4c7e95631e17f82a62901f23c640015ef42c0e4e57967cead3b053fcd57fd9fe066af67cc19d538e9827d06ee164d86a23d40c2f7641292f2a95df1af
SSDEEP

1536:d4hybgLBvX9P6bdfarOaO5wFEaCnMoouE7qrFSmL56MVZ88:dwW2vtPAparq5znMoFpFSmL5bZv

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 2208	1660	rundll32.exe	28
PID 1660 wrote to memory of 2208	1660	rundll32.exe	28
PID 1660 wrote to memory of 2208	1660	rundll32.exe	28
PID 1660 wrote to memory of 2208	1660	rundll32.exe	28
PID 1660 wrote to memory of 2208	1660	rundll32.exe	28
PID 1660 wrote to memory of 2208	1660	rundll32.exe	28
PID 1660 wrote to memory of 2208	1660	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bass.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bass.dll,#1
  2⤵
  PID:2208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2208-0-0x0000000010000000-0x000000001005A000-memory.dmp

Filesize
360KB

Download
memory/2208-1-0x0000000010000000-0x000000001005A000-memory.dmp

Filesize
360KB

Download
memory/2208-2-0x0000000010000000-0x000000001005A000-memory.dmp

Filesize
360KB

Download