c047afe17088463f18af5db67f61ad051fdca8172d146f37669cb92a7fc92947 | Triage

Analysis

max time kernel
359s
max time network
361s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/03/2024, 14:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Borion.dll
Size

6.0MB
MD5

31869311eddb18b0b215aa1d39830e31
SHA1

b151bc243b52764d888d91ac4b74dba2a54ac030
SHA256

c047afe17088463f18af5db67f61ad051fdca8172d146f37669cb92a7fc92947
SHA512

76f0fb73acfba9870f4a89a05420e74fb004bae81786a52f06ab70286c56b7d67b4f2e82583a54dec798f677c1e1575d369e0f3c59a6dc73fd680f3ca73cf949
SSDEEP

98304:d6rZ583onjvxlAJ0pESQfPazoIvHi69PTHFX:dwZ583ojvLESNBH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 2820	2952	rundll32.exe	28
PID 2952 wrote to memory of 2820	2952	rundll32.exe	28
PID 2952 wrote to memory of 2820	2952	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Borion.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2952 -s 56
  2⤵
  PID:2820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads