a535a2972896469da575cfacf81589fa2386a82499d148214b563548368e8100 | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 18:44

Sharing

Report Analysis Logs

General

Target

gspfxt2/XTRAS/MIXVIEW.dll
Size

46KB
MD5

1c3761250de05a9cf46be25867acc1c5
SHA1

32643c831ba58ce16245bf06f55e6beb2ad082be
SHA256

3d78377687e9c5be822ff1cdb78a145e515b815ac2721f3b233e38c79ac6c73e
SHA512

9d7ba1948072310b200b270f83df901f61d59f47b565dab982cedd522317320f6c44b10f7ae4bede5b346a7feec8561f78113ca01eb651b24e2d21dd84282258
SSDEEP

768:86cRW9Eibtuc440rdPAB2jmDWrFUHGZNRMsc1NV2AZEKZy2:ER3iJuvprOBn6rFZZjMsiAM

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2340 wrote to memory of 1032	2340	rundll32.exe	rundll32.exe
PID 2340 wrote to memory of 1032	2340	rundll32.exe	rundll32.exe
PID 2340 wrote to memory of 1032	2340	rundll32.exe	rundll32.exe
PID 2340 wrote to memory of 1032	2340	rundll32.exe	rundll32.exe
PID 2340 wrote to memory of 1032	2340	rundll32.exe	rundll32.exe
PID 2340 wrote to memory of 1032	2340	rundll32.exe	rundll32.exe
PID 2340 wrote to memory of 1032	2340	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gspfxt2\XTRAS\MIXVIEW.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2340

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gspfxt2\XTRAS\MIXVIEW.dll,#1
2⤵
PID:1032

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...