fcfcea85a15e4cfeb120fb025974a9c3c115bba77f1ed860782861bec4e0b926 | Triage

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-04-2024 19:38

Sharing

Report Analysis Logs

General

Target

DataMaster.Providers.CrsData.dll
Size

31KB
MD5

117e9b7beba02ea85b0e226339a16da3
SHA1

d3c1961cef29e0e83e39bcfe8f1143cd77832706
SHA256

662038d8bea914df39196d0aca3fec3f7ec87392161f215625e08f47e7cadaa5
SHA512

2a1950fc6e6114e90e151a82f37480ac4f207e1730937dabf448d1a4a02952617ccaa511c3a8dc2fc301e4aedd2dfd8783b5c5a22fef432de1ca2385a2f1bf0f
SSDEEP

768:yYVggc0nv8C4XPL3CEkerFHiVacVqrVwrFy:yYVTcgv8C4XAeuJy

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1772 wrote to memory of 2816	1772	rundll32.exe	rundll32.exe
PID 1772 wrote to memory of 2816	1772	rundll32.exe	rundll32.exe
PID 1772 wrote to memory of 2816	1772	rundll32.exe	rundll32.exe
PID 1772 wrote to memory of 2816	1772	rundll32.exe	rundll32.exe
PID 1772 wrote to memory of 2816	1772	rundll32.exe	rundll32.exe
PID 1772 wrote to memory of 2816	1772	rundll32.exe	rundll32.exe
PID 1772 wrote to memory of 2816	1772	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DataMaster.Providers.CrsData.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1772

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DataMaster.Providers.CrsData.dll,#1
2⤵
PID:2816

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...