4b7abdcb2c958a551b20d87025adb7bcb12ab3fe5f063c5b10461c775e7aab8b | Triage

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-04-2024 19:11

Sharing

Report Analysis Logs

General

Target

Samples/VB/Cli_AP.dll
Size

196KB
MD5

29feb5f8046ff3d3c8d68a27da2ea5cb
SHA1

a4cf45d89819dc9e8a3d0fa7f97ee51be3017314
SHA256

429778464bd0211a808d95d8dd3bb5fb49226aaf93061c67f211cbcc7c04f444
SHA512

7b70e7d66001edfe65de3910e6af1cb6491934b8e843ed30397880fafc4c6faa8f59a98537c58ab08e43db08b2430efdc09283de24e886fc7e1fa55a0a54f2a0
SSDEEP

3072:i/ucoihhiw18ZOu5xbfNYoW8T5LLIJUlU:iKiyc8Zj5Sd

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2124	2264	rundll32.exe	28
PID 2264 wrote to memory of 2124	2264	rundll32.exe	28
PID 2264 wrote to memory of 2124	2264	rundll32.exe	28
PID 2264 wrote to memory of 2124	2264	rundll32.exe	28
PID 2264 wrote to memory of 2124	2264	rundll32.exe	28
PID 2264 wrote to memory of 2124	2264	rundll32.exe	28
PID 2264 wrote to memory of 2124	2264	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Samples\VB\Cli_AP.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Samples\VB\Cli_AP.dll,#1
  2⤵
  PID:2124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads