e72826c3dbd6781eaa34b9ec33e276f6d811c36c3a6ced9ae95e67fbf1c7cf8c | Triage

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 17:35

Sharing

Report Analysis Logs

General

Target

wjpjk/Support/asycfilt.dll
Size

144KB
MD5

9f81f05a9a9c7b94790e4bebe2feb112
SHA1

0e9e7d035ce7d23b341c72d0287568b970e1e47b
SHA256

5ee35e51cc4eae26d84fbb3419cc74b11d1108802427f861a7e3dd2a09a48412
SHA512

31769dde653ffc6ad9bf58e2dd9b6aba2b3510ea08d67fa758d099c244249a31b433b2f3b859e673bad87c0613254c744d336394b05d5e87d5865a85813d727c
SSDEEP

3072:cQNxaJt42UMPls65T9CCL7FwiHIakbg9nqEz:NNxaJt2i1hCCLZHw8n5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2868	2320	rundll32.exe	28
PID 2320 wrote to memory of 2868	2320	rundll32.exe	28
PID 2320 wrote to memory of 2868	2320	rundll32.exe	28
PID 2320 wrote to memory of 2868	2320	rundll32.exe	28
PID 2320 wrote to memory of 2868	2320	rundll32.exe	28
PID 2320 wrote to memory of 2868	2320	rundll32.exe	28
PID 2320 wrote to memory of 2868	2320	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\wjpjk\Support\asycfilt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\wjpjk\Support\asycfilt.dll,#1
  2⤵
  PID:2868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads