a535a2972896469da575cfacf81589fa2386a82499d148214b563548368e8100 | Triage

Analysis

max time kernel
118s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 18:44

Sharing

Report Analysis Logs

General

Target

gspfxt2/XTRAS/DmPack1.dll
Size

70KB
MD5

38c4fa107984a5d7ae22449a15848a57
SHA1

ba863b871a74c1fec14ed11d48f20262d5bf082b
SHA256

da93460f6e8e34656e013ba117b3110aa5f050ae92717c1502a64b017089e55d
SHA512

29fc9cbe58fe602c494d6d83282eba5af8812b04c54f3fba1c31aef817f7022acac60bddab877f3c7094145168c7733a9052057c9fc5393becbd40b5aebf09bc
SSDEEP

1536:hu2uDz9TNHtWWetIxuWuUmF5JFsQgKaAdfLS:hu2uDz9TNH4WSYvayQgK7zS

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1728 wrote to memory of 2772	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 2772	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 2772	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 2772	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 2772	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 2772	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 2772	1728	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gspfxt2\XTRAS\DmPack1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gspfxt2\XTRAS\DmPack1.dll,#1
2⤵
PID:2772

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...