2769155d033b0441b80165f00a126db615ba18046ae0a952c9d145ee4ce1b0ae | Triage

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 07:23

Sharing

Report Analysis Logs

General

Target

$APPDATA/24/remind/domains/lregdll.dll
Size

10KB
MD5

abb5327b536728af743f5ec484e5699f
SHA1

e9bfc702e574db897740f2d731a7e0993d80a55f
SHA256

9ec4c2b05238e0fe4e5811c0d237d437dcc99ee9cdcb02765dc00659423b26d3
SHA512

c5372244db1db0c581ffcceb19401e6abbd4d92c7bb2ef6fdc5c7cebc7a3a13bbcb2cd6e882e89841170824556bf959d0f85bc7a95031d5c32803809167d5350
SSDEEP

192:OknPG2jjRfI3X6626vrkok6RXYW1dNd3WNViu:beoOK6265qW1fd3WPb

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 2840	1404	rundll32.exe	28
PID 1404 wrote to memory of 2840	1404	rundll32.exe	28
PID 1404 wrote to memory of 2840	1404	rundll32.exe	28
PID 1404 wrote to memory of 2840	1404	rundll32.exe	28
PID 1404 wrote to memory of 2840	1404	rundll32.exe	28
PID 1404 wrote to memory of 2840	1404	rundll32.exe	28
PID 1404 wrote to memory of 2840	1404	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\24\remind\domains\lregdll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\24\remind\domains\lregdll.dll,#1
  2⤵
  PID:2840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads