2769155d033b0441b80165f00a126db615ba18046ae0a952c9d145ee4ce1b0ae | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 07:23

Sharing

Report Analysis Logs

General

Target

$TEMP/ShoonCataclysm.dll
Size

48KB
MD5

6864b4b87cb50d998f8c3d583e0e5bf3
SHA1

c90c3de34d735e40a81e42254f60453ac8cff190
SHA256

178b978482f6ede2219513d9dbbce2df3d09e188114a8eb4caca7d4390c03f17
SHA512

2db7f163c3364fdb2e06e8c67062f2fdcf243358fe9d156e3da0ccac3876e75e4870450e20cd46e67b1ce32ee59231e81ef7ccf0c6af432d4061c93667e4feba
SSDEEP

768:1/4Clb6KhYKJbfJF61tthuLjpJ1x57019+6J6HTTDWm7bQhudae5:J4yDwtqjpnq7JSTn

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2220	2184	rundll32.exe	28
PID 2184 wrote to memory of 2220	2184	rundll32.exe	28
PID 2184 wrote to memory of 2220	2184	rundll32.exe	28
PID 2184 wrote to memory of 2220	2184	rundll32.exe	28
PID 2184 wrote to memory of 2220	2184	rundll32.exe	28
PID 2184 wrote to memory of 2220	2184	rundll32.exe	28
PID 2184 wrote to memory of 2220	2184	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\ShoonCataclysm.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\ShoonCataclysm.dll,#1
  2⤵
  PID:2220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads