4ef76b942e041c20fd58858d73b4180688c828608d42604eabf41821981ce997 | Triage

Analysis

max time kernel
26s
max time network
19s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-04-2024 21:11

Sharing

Report Analysis Logs

General

Target

g2m.dll
Size

394KB
MD5

bfdc1d6b753467fb5f1be175beca514e
SHA1

36bb052c5c55a655b670bd728e8915fb8a0f2b1f
SHA256

459557df57eb1e1925fc3130effe1a841867eb5cd450f8cb447fc00e3113d4d2
SHA512

db58afe532944a66c76a10f3cbaf29ab4403e71b78c149ef6063fbc3b023dfbe8c66cdfd3fb3aaacc090b34b38d87c7cbb4d57bf5460709d77161b0f1a1400b7
SSDEEP

6144:c/tGvR6jAvLYCfNdrVD49mkqjLeM4ZWhdR/WQy5tjQuUqcLpH0:cMpvDNA9mkqJzhdR/dUOLpH0

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3008 wrote to memory of 2752	3008	rundll32.exe	rundll32.exe
PID 3008 wrote to memory of 2752	3008	rundll32.exe	rundll32.exe
PID 3008 wrote to memory of 2752	3008	rundll32.exe	rundll32.exe
PID 3008 wrote to memory of 2752	3008	rundll32.exe	rundll32.exe
PID 3008 wrote to memory of 2752	3008	rundll32.exe	rundll32.exe
PID 3008 wrote to memory of 2752	3008	rundll32.exe	rundll32.exe
PID 3008 wrote to memory of 2752	3008	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\g2m.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3008

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\g2m.dll,#1
2⤵
PID:2752

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...