a535a2972896469da575cfacf81589fa2386a82499d148214b563548368e8100 | Triage

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 18:44

Sharing

Report Analysis Logs

General

Target

gspfxt2/XTRAS/INETURL.dll
Size

72KB
MD5

a4ad90a86143454149cf54297f59e68b
SHA1

25909aba3410570c34b57a732c253d7dee22ea9b
SHA256

23fb5e01cf37d3473b34ed2f2578881f8486b27778cb588196ff4bfcb477cb5b
SHA512

d0eeb70139bd2fa57066475881bb30e24fbc16b5f032acd261fffd0ca4c3ce6d192d402496f859476d87c5ddd7ccc16de030414d7e08df22aec7eb8184249ad8
SSDEEP

1536:jSl/qDfpPzjIe6l6Mxta3f+cLk+BfZn1BFjGi:GGpLD9aaXo+1Zn1rj7

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2228 wrote to memory of 1732	2228	rundll32.exe	rundll32.exe
PID 2228 wrote to memory of 1732	2228	rundll32.exe	rundll32.exe
PID 2228 wrote to memory of 1732	2228	rundll32.exe	rundll32.exe
PID 2228 wrote to memory of 1732	2228	rundll32.exe	rundll32.exe
PID 2228 wrote to memory of 1732	2228	rundll32.exe	rundll32.exe
PID 2228 wrote to memory of 1732	2228	rundll32.exe	rundll32.exe
PID 2228 wrote to memory of 1732	2228	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gspfxt2\XTRAS\INETURL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2228

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gspfxt2\XTRAS\INETURL.dll,#1
2⤵
PID:1732

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...