0b18ba0573f449ecb8b796c4496b14e94ae745dccfb7568545be7dace8489a6c | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
16-04-2024 00:13

Sharing

Report Analysis Logs

General

Target

components/foo_midi.dll
Size

256KB
MD5

03637ffe6da6bd53b746018b8e86013f
SHA1

bf672680c8e725bd6b863783dd226a97147f2d11
SHA256

c09418dbe445b92fd1b2e3da324b7ecdf2c5956e7309051a6a44b77fceec4050
SHA512

70961dd881eab79697a0ffd7d41cd934efdc3fc9756eaa4786b59598f1a93bdacff6cfa744b1f03275eea409fa2c52594bf41bf3a6b15efb38337040e8553ba3
SSDEEP

6144:3ipoaa4Jr67Ht0oPS68yuQsAJZ+sAOtvHF:36Pa4Jrz6sQNX+sb/F

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 2192	1920	rundll32.exe	28
PID 1920 wrote to memory of 2192	1920	rundll32.exe	28
PID 1920 wrote to memory of 2192	1920	rundll32.exe	28
PID 1920 wrote to memory of 2192	1920	rundll32.exe	28
PID 1920 wrote to memory of 2192	1920	rundll32.exe	28
PID 1920 wrote to memory of 2192	1920	rundll32.exe	28
PID 1920 wrote to memory of 2192	1920	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\components\foo_midi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\components\foo_midi.dll,#1
  2⤵
  PID:2192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2192-0-0x0000000010000000-0x00000000100AB000-memory.dmp

Filesize
684KB

Download
memory/2192-1-0x0000000010000000-0x00000000100AB000-memory.dmp

Filesize
684KB

Download