750c447d6e3c7d74ccab736a0082ef437b1cd2000d761d3aff2b73227457b29c | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-04-2024 11:54

Sharing

Report Analysis Logs

General

Target

libgthread-2.0-0.dll
Size

43KB
MD5

7ad6f303082b382bff7bafbab246c61f
SHA1

8d94c4d4b0633a80e28504a3c694dd2bae252854
SHA256

ee2e8485fdbfb2c5626099ccafcdc41ac60414dffd5c6c3befaf786634baf5c3
SHA512

eee840f217ff65b22efd16e78fb898990116efdfb6ee1cbf9d9fb64b9f3209f18860f6477c1df60352fb242671d973dcac043134748f823d210fc393ed4e2598
SSDEEP

768:OwrBdO1XBfXbbeHFolT8EiH8PWVLCfn7Hve2f3vSEWLxUswVwn:700Ojv1vwL7

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2760	2292	rundll32.exe	28
PID 2292 wrote to memory of 2760	2292	rundll32.exe	28
PID 2292 wrote to memory of 2760	2292	rundll32.exe	28
PID 2292 wrote to memory of 2760	2292	rundll32.exe	28
PID 2292 wrote to memory of 2760	2292	rundll32.exe	28
PID 2292 wrote to memory of 2760	2292	rundll32.exe	28
PID 2292 wrote to memory of 2760	2292	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libgthread-2.0-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libgthread-2.0-0.dll,#1
  2⤵
  PID:2760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads