750c447d6e3c7d74ccab736a0082ef437b1cd2000d761d3aff2b73227457b29c | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-04-2024 11:54

Sharing

Report Analysis Logs

General

Target

xmlparse.dll
Size

52KB
MD5

4bf2029bbeda32417ed67f7b4cd924d2
SHA1

507cc7823ecbbe1734d4cad0a760b021c80512b0
SHA256

9a111643f7241d818a313fd8657f519dcff63a4235f5baa5a015abc65cb5073f
SHA512

ef190e5dada4dfd2fd1a9e78bed8dca3222da1083258e4f428867e62ca39d7a42ee4fce2142304be45c4c5a093f24e4a11b7c64fb78e10017c88e1101afb2bad
SSDEEP

768:Bqh2pNq38vL5VCdLOA89r7hSciQpEmqLr5BNMxvceJo93zp:zpg381V2Ox9rFScidLrNMxTo

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 364	1392	rundll32.exe	28
PID 1392 wrote to memory of 364	1392	rundll32.exe	28
PID 1392 wrote to memory of 364	1392	rundll32.exe	28
PID 1392 wrote to memory of 364	1392	rundll32.exe	28
PID 1392 wrote to memory of 364	1392	rundll32.exe	28
PID 1392 wrote to memory of 364	1392	rundll32.exe	28
PID 1392 wrote to memory of 364	1392	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\xmlparse.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\xmlparse.dll,#1
  2⤵
  PID:364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads