87ea69570136c63736d95fd3950e11c67fd37ab1053410bc9e4aca66805a4cd9 | Triage

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-03-2024 01:23

Sharing

Report Analysis Logs

General

Target

XInput9_1_0.dll
Size

11KB
MD5

c5fe86cc2025ea38f5b4a584d99d6c4f
SHA1

eb6135c4751761ccafaee78e884207686eccd94d
SHA256

9018ab4c056298b1fe30103b13f1d762c7048e83d1730893dcbf2294bbb73269
SHA512

58294c13e04a8c3956e0bdd97a0f087dcf4b12be3a7970b5b1837a8dc760e0719c8774cd88c6ecaac74a7dda6177fa3a8653ab7505c38fa396905e4aaeabb559
SSDEEP

192:XQdcdW6Ss9HI23vSdZXShyWJT/BEaE+EgwijOymaCwmPgbDLTGc:j/SspI2WgHJZlj/ma/tvi

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1824 wrote to memory of 1372	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 1372	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 1372	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 1372	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 1372	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 1372	1824	rundll32.exe	rundll32.exe
PID 1824 wrote to memory of 1372	1824	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XInput9_1_0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1824

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XInput9_1_0.dll,#1
2⤵
PID:1372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads