21e431d36e4c3100b886e644d544d7e4458a83322dd7d15257e1badc95af83a9 | Triage

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 02:00

Sharing

Report Analysis Logs

General

Target

divxa32.dll
Size

281KB
MD5

8b32d7f2c98e4ce24ca678551ee3f780
SHA1

86edcd7411e1aa6b485dddd3bd1088448ea266e4
SHA256

0d0e863237d1083c6580b40cc6936d1d3fec1e1fa0f67c0748fb350613d17238
SHA512

2018e0c6ed4c162b811df07f80d76724f32af85fb3f8aee7e59acfc1a80dac09c462c9be87880e699caa00a4908008ec1b6eb00b6e5cba7f1dcb8763452e4566
SSDEEP

6144:+e6d1RrhTbikNOxWWclJyBXTI5vnvLBP4X1j5uHhFv9n:+e4rr82ylEnTBP4TM9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 1352	2124	rundll32.exe	28
PID 2124 wrote to memory of 1352	2124	rundll32.exe	28
PID 2124 wrote to memory of 1352	2124	rundll32.exe	28
PID 2124 wrote to memory of 1352	2124	rundll32.exe	28
PID 2124 wrote to memory of 1352	2124	rundll32.exe	28
PID 2124 wrote to memory of 1352	2124	rundll32.exe	28
PID 2124 wrote to memory of 1352	2124	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\divxa32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\divxa32.dll,#1
  2⤵
  PID:1352

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads