a6eb7a7372c462b2e181014540491a062c540edc4ba0f65a9169cfbfb473e6c7 | Triage

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 07:17

Sharing

Report Analysis Logs

General

Target

bin/dbghelp.dll
Size

1.2MB
MD5

4003e34416ebd25e4c115d49dc15e1a7
SHA1

faf95ec65cde5bd833ce610bb8523363310ec4ad
SHA256

c06430b8cb025be506be50a756488e1bcc3827c4f45158d93e4e3eeb98ce1e4f
SHA512

88f5d417377cd62bde417640a79b6ac493e80f0c8b1f63a99378a2a67695ef8e4a541cedb91acfa296ed608e821fee466983806f0d082ed2e74b0cd93eb4fb84
SSDEEP

24576:9AkmijauMug/iyFzb2DfsPV8A4C2vNI1cPdf8xZLGNfav9T:9WiOuRg/iyFzb2QN83XfeYaZ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2076	2980	rundll32.exe	28
PID 2980 wrote to memory of 2076	2980	rundll32.exe	28
PID 2980 wrote to memory of 2076	2980	rundll32.exe	28
PID 2980 wrote to memory of 2076	2980	rundll32.exe	28
PID 2980 wrote to memory of 2076	2980	rundll32.exe	28
PID 2980 wrote to memory of 2076	2980	rundll32.exe	28
PID 2980 wrote to memory of 2076	2980	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\dbghelp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\dbghelp.dll,#1
  2⤵
  PID:2076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads