750c447d6e3c7d74ccab736a0082ef437b1cd2000d761d3aff2b73227457b29c | Triage

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-04-2024 11:54

Sharing

Report Analysis Logs

General

Target

bass.dll
Size

126KB
MD5

d697cef8a405bddd95ad05d97e997b16
SHA1

971cef29794c10b874e82e267237189bb680bb42
SHA256

5c39202c34a55ad6b75914b2b9db5281fd9b5a7c61d5399a2527f37106b115e8
SHA512

54dbf28bf47e2732ddfdcc48efcb8b92a52d86ba4b38c0943554bc0e631edf76e4a35d67f472e4ef8b2ae6b6949dac51998e27bcb4fdd374b0145126654f0b72
SSDEEP

3072:8wbizLcb+pGOo7H07h4FaNXLeoszGre+bv8CIcBPkn0tm6t/2Ak4ggf:8Ki/cbnj0h73szGBXIVn0tX/HNr

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2504	2164	rundll32.exe	28
PID 2164 wrote to memory of 2504	2164	rundll32.exe	28
PID 2164 wrote to memory of 2504	2164	rundll32.exe	28
PID 2164 wrote to memory of 2504	2164	rundll32.exe	28
PID 2164 wrote to memory of 2504	2164	rundll32.exe	28
PID 2164 wrote to memory of 2504	2164	rundll32.exe	28
PID 2164 wrote to memory of 2504	2164	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bass.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bass.dll,#1
  2⤵
  PID:2504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2504-0-0x0000000074450000-0x00000000744A8000-memory.dmp

Filesize
352KB

Download
memory/2504-2-0x0000000000120000-0x000000000013C000-memory.dmp

Filesize
112KB

Download