b4d74473cb5f2aeed8ba8f2e54419370d6c6e5dd0cf3afa12259a000fed96101 | Triage

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-04-2024 13:54

Sharing

Report Analysis Logs

General

Target

version1.dll
Size

1.5MB
MD5

b940f9dc5e1f90b9366af62399d9b147
SHA1

ed6367f231ae4c810342e3f31ff7f57738049469
SHA256

221e906b73db3dd177f65eba9310efeb2921f512d1eb67d516d8036b4193344e
SHA512

cc9d754e15259456ad4d0d3f459dfa2065bcc5ea266d4327f9050c27a33c4b4406ed862e2fcb1d4b7a1d37b2ac27d9e705ff7a0a3d7fb711f55dd7c955fa6843
SSDEEP

12288:e3ZJHttTLoh9ZyM67XI25eXAezXiULjiEG7:e33HTLoh9ZyMY425eQmiUL+E

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 1744	2524	rundll32.exe	28
PID 2524 wrote to memory of 1744	2524	rundll32.exe	28
PID 2524 wrote to memory of 1744	2524	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\version1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2524 -s 80
  2⤵
  PID:1744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2524-0-0x0000000180000000-0x0000000180188000-memory.dmp

Filesize
1.5MB

Download