a535a2972896469da575cfacf81589fa2386a82499d148214b563548368e8100 | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 18:44

Sharing

Report Analysis Logs

General

Target

gspfxt2/XTRAS/MOAFILE2.dll
Size

57KB
MD5

51fc98e25386fbc0a4e984142c0899ba
SHA1

3f3b1f52cf908e4b8a79b5e27e5c79010fbc6c81
SHA256

5cb60268a15a9b5a1c0d4914b3305a51b089fe0243c52fe68af6fa659c7d0edf
SHA512

3c211520c4ea325ec2ca2b3432a1d24859581f0920e0bb2a063a2305989ec1399d209051930d173b7bf27b04fea2ba803af459801e1516d70befd40c0ecf7619
SSDEEP

1536:XwqFSXgRaejfTTV+S3oZE3rZa9Z4MY5nmVJa0cj:ADuae/J+JEbZ+Y5nn0cj

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1700 wrote to memory of 2120	1700	rundll32.exe	rundll32.exe
PID 1700 wrote to memory of 2120	1700	rundll32.exe	rundll32.exe
PID 1700 wrote to memory of 2120	1700	rundll32.exe	rundll32.exe
PID 1700 wrote to memory of 2120	1700	rundll32.exe	rundll32.exe
PID 1700 wrote to memory of 2120	1700	rundll32.exe	rundll32.exe
PID 1700 wrote to memory of 2120	1700	rundll32.exe	rundll32.exe
PID 1700 wrote to memory of 2120	1700	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gspfxt2\XTRAS\MOAFILE2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1700

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gspfxt2\XTRAS\MOAFILE2.dll,#1
2⤵
PID:2120

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...