8398f9158dd22bfb3d847b38495a2720a73d83df4dc8c332837c97282cf56b98 | Triage

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/03/2024, 16:42

Sharing

Report Analysis Logs

General

Target

scripts/zAnimPlayer.dll
Size

6KB
MD5

3fe41d9d7d104912ca2d0660825e4ccb
SHA1

cc0790c29d6c7f363a245578e59be1cb5416fc88
SHA256

cb349ffb36ba18289051d8287f8d640e11604eb990ac9317ac811769db281e68
SHA512

07b0ec6cf12b21133c5b268557df304bfb95c026b229c3ce3dfd95d09ad24d53e719302fe5d995758bf3a4f003a3311b8141242c4c9bffc4115a4fc8344234ee
SSDEEP

96:slYmg8QiwVe2pd4dzhNv4zevR66f4uS4J2XQ:saBeMd4/df4oJ2g

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2392	2356	rundll32.exe	28
PID 2356 wrote to memory of 2392	2356	rundll32.exe	28
PID 2356 wrote to memory of 2392	2356	rundll32.exe	28
PID 2356 wrote to memory of 2392	2356	rundll32.exe	28
PID 2356 wrote to memory of 2392	2356	rundll32.exe	28
PID 2356 wrote to memory of 2392	2356	rundll32.exe	28
PID 2356 wrote to memory of 2392	2356	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\scripts\zAnimPlayer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\scripts\zAnimPlayer.dll,#1
  2⤵
  PID:2392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads