7595471a5408461166040f96c51a9f9b6d3e2f79d27c7bbd22d77a11ddbd48a9 | Triage

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
11/04/2024, 14:51

Sharing

Report Analysis Logs

General

Target

EzSSSEditor.dll
Size

1.4MB
MD5

1b63bdf89a772b6c7be4ad7441bd99b9
SHA1

33e27863ca4e89a411965806b7de25cef6e97478
SHA256

4b8d3887c4531f1d8221c625445691222f799da25ab1b5b4e734778b6d2eaad8
SHA512

e664ad2c5e0a1103346c2be3abc2f6136133883b5a46373d4fe98284ca951a26ac9291511a5e1c8bb95061b1e203630afd13883b4717a49e639c4c7521f0fa96
SSDEEP

24576:RI5BeU0W83UxOZ/ohFS+9AjnyMehVMUL4WMHwSGlh2/:yeANOZQVsyMwOULCOl

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2740	2204	rundll32.exe	28
PID 2204 wrote to memory of 2740	2204	rundll32.exe	28
PID 2204 wrote to memory of 2740	2204	rundll32.exe	28
PID 2204 wrote to memory of 2740	2204	rundll32.exe	28
PID 2204 wrote to memory of 2740	2204	rundll32.exe	28
PID 2204 wrote to memory of 2740	2204	rundll32.exe	28
PID 2204 wrote to memory of 2740	2204	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\EzSSSEditor.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\EzSSSEditor.dll,#1
  2⤵
  PID:2740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2740-0-0x0000000001FC0000-0x0000000002135000-memory.dmp

Filesize
1.5MB

Download