a6eb7a7372c462b2e181014540491a062c540edc4ba0f65a9169cfbfb473e6c7 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 07:17 UTC

Sharing

Report Analysis Logs

General

Target

bin/usysdiag.dll
Size

376KB
MD5

4c5db6477ea151be370854b1346eeda0
SHA1

4234cc1bc932dd2ab7ee09b83dcf11f1caa87dfa
SHA256

b953561bb3f79136d51e3a23ee96615b68738d7409e034b8955eba6b671a5a3e
SHA512

4972a36b02f246cd132ff6b038604ca938b0a897dbe4222162c93d8f44e3b0fadd64552c2959953cdbbc6d05c0dd8c698a0c59d261d25e01066e74cca6825fde
SSDEEP

6144:l0/air/OzCSvvSCLmqD50P6oxtXYrQJZrGjfpr1ZQzKjJWSn:l0R/ORSg50ioxyEZIfpr1eGdWSn

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 1956	2512	rundll32.exe	28
PID 2512 wrote to memory of 1956	2512	rundll32.exe	28
PID 2512 wrote to memory of 1956	2512	rundll32.exe	28
PID 2512 wrote to memory of 1956	2512	rundll32.exe	28
PID 2512 wrote to memory of 1956	2512	rundll32.exe	28
PID 2512 wrote to memory of 1956	2512	rundll32.exe	28
PID 2512 wrote to memory of 1956	2512	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\usysdiag.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\usysdiag.dll,#1
  2⤵
  PID:1956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads