0ecb58eff1dd7994f3af2aa57dafb3f86cc802c7cd152b9f19cdfe7e5aea9cc9 | Triage

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 12:19

Sharing

Report Analysis Logs

General

Target

bass.dll
Size

96KB
MD5

8741c1669550d89bc781dfa5ac11da8b
SHA1

d083e66010aa0f884ad80823384e7f50c3eaaf68
SHA256

91dabc42430075dd6b29a143a6cbed02e2135b3db9f76bd90ddd7621a13da54d
SHA512

e7d0a0bf6852eb9ec24bf1e9e7546276469e6445437e949507facfc22009e3dc82994d6e9ed9aaeff9fc90c89507f325e47344d22d00d04238205873ce24fb01
SSDEEP

1536:jYcrMnh/DhwDXL0vhRZ9KEsgAL6OeUko/wToQUe4E8Gf6cp5WDXLbfYEjr/9:s+Mh/dzZg5gfTgSoq4PGScpkLbh

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 2980	2712	rundll32.exe	28
PID 2712 wrote to memory of 2980	2712	rundll32.exe	28
PID 2712 wrote to memory of 2980	2712	rundll32.exe	28
PID 2712 wrote to memory of 2980	2712	rundll32.exe	28
PID 2712 wrote to memory of 2980	2712	rundll32.exe	28
PID 2712 wrote to memory of 2980	2712	rundll32.exe	28
PID 2712 wrote to memory of 2980	2712	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bass.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bass.dll,#1
  2⤵
  PID:2980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2980-0-0x0000000011000000-0x0000000011062000-memory.dmp

Filesize
392KB

Download
memory/2980-1-0x0000000011000000-0x0000000011062000-memory.dmp

Filesize
392KB

Download
memory/2980-2-0x0000000011000000-0x0000000011062000-memory.dmp

Filesize
392KB

Download