a6eb7a7372c462b2e181014540491a062c540edc4ba0f65a9169cfbfb473e6c7 | Triage

Analysis

max time kernel
45s
max time network
16s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 07:17

Sharing

Report Analysis Logs

General

Target

bin/behavior.dll
Size

245KB
MD5

cf5d7b176a13b35e03eb290ba9dbe48f
SHA1

1ac8472d1c0451ef06e77e22698e8a67033c99dd
SHA256

a568ed9abc1cacd846bea4f741d87aa4843fef76c168d3d94c890ee89b2fd65f
SHA512

3da5bac4c209eaf04f1cc9709602a6117c8d9602c06073180d94ed7b6469ca18ae2b731a0076b33dc5330b142e24680d3eda36ebba4da075384ead009c98c897
SSDEEP

6144:zWg4taTsyJTOPetiM6FdhrUSBhuL/YDCCCCCCCCCTxEK:J4tMsyJeetiDHrUSBYT7CCCCCCCCTxEK

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1884	1728	rundll32.exe	29
PID 1728 wrote to memory of 1884	1728	rundll32.exe	29
PID 1728 wrote to memory of 1884	1728	rundll32.exe	29
PID 1728 wrote to memory of 1884	1728	rundll32.exe	29
PID 1728 wrote to memory of 1884	1728	rundll32.exe	29
PID 1728 wrote to memory of 1884	1728	rundll32.exe	29
PID 1728 wrote to memory of 1884	1728	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\behavior.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\behavior.dll,#1
  2⤵
  PID:1884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads