a6eb7a7372c462b2e181014540491a062c540edc4ba0f65a9169cfbfb473e6c7 | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 07:17

Sharing

Report Analysis Logs

General

Target

bin/libxsse.dll
Size

537KB
MD5

c39b00b17ca0a7b6bfc8c9ef8173538c
SHA1

6ad0c0328b42d48a1143cc60f51d36cb957f6d52
SHA256

9e445972a2d9736e69629e42432e7f38ca22e119ca2bc3aff92144a2ef991e6b
SHA512

953f8c5901111af091845ccad9fe975f5da8491d9a970217953723c4d4d9cf78348ace3d04f4fa67862a2003de563816d0d26cbe971f27b8d45b11f6e37a1b2a
SSDEEP

12288:YXNB4Bg+m6QyDJMPdUBsHApSgpPLtKIPOFgU/jTsamATtuzN:HQ6QuJMFUBDpRLtKImFguThTtuzN

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2988	2976	rundll32.exe	28
PID 2976 wrote to memory of 2988	2976	rundll32.exe	28
PID 2976 wrote to memory of 2988	2976	rundll32.exe	28
PID 2976 wrote to memory of 2988	2976	rundll32.exe	28
PID 2976 wrote to memory of 2988	2976	rundll32.exe	28
PID 2976 wrote to memory of 2988	2976	rundll32.exe	28
PID 2976 wrote to memory of 2988	2976	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\libxsse.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\libxsse.dll,#1
  2⤵
  PID:2988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads