41513d1bd65062c3e4b337f50c2fbc914f035d17e258e7622574e867065f79f3 | Triage

Resubmissions

05-04-2024 15:05

240405-sf5bqaff88 10

27-11-2023 17:10

231127-vpqk2aae84 8

27-11-2023 16:30

231127-tzsbyahg8y 7

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
05-04-2024 15:05

Sharing

Report Analysis Logs

General

Target

version1.dll
Size

1.4MB
MD5

f834dfc1861cd6361f34496c3bbafe66
SHA1

a983e82d009901310c8a3255c4b4e3a02d556fa7
SHA256

e99f3517a36a9f7a55335699cfb4d84d08b042d47146119156f7f3bab580b4d7
SHA512

088a6170c948ddb2c2b0cf2431ae61688201ef5bc3f1af217a58bf18b26dd9e0ab7ee082f822e736d0467f62e33bf71b806127eb998bed8e739c1e441ac05e00
SSDEEP

12288:kX/1RzJk1HRqZr4y6mLsM5k6tQqNaCPWIzv:+XzJk1HwZL6GQCPP

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 1660	1756	rundll32.exe	28
PID 1756 wrote to memory of 1660	1756	rundll32.exe	28
PID 1756 wrote to memory of 1660	1756	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\version1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1756 -s 80
  2⤵
  PID:1660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads