70033a2b131c5d3ae450eee9d4e6a368f75e49951e5851189540f9c9b7fcc9e7 | Triage

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 02:54

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/Banner.dll
Size

477KB
MD5

7a7127c1c951833b9b752b5b55aecd1c
SHA1

86bdfd31cf14a831b89deb6852292ae012049a98
SHA256

7b66a639beb9754776bdf123b0a389c83de2003c416fbd9d0488ab32e3f1f921
SHA512

6b4631d294cdea1c76bfc2a7c9900364be7499e184eaf0be4cfcafe75c775ce057eb9940dcab85d97f6a75b4e29e8bde9c76d412366d9100623aaff69ba8f8b1
SSDEEP

6144:F3qujs8hR5ycAT21eRBfE6LzA8zjZGeCD:u8RyRAeXfECA8zlG

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3048 wrote to memory of 2924	3048	rundll32.exe	rundll32.exe
PID 3048 wrote to memory of 2924	3048	rundll32.exe	rundll32.exe
PID 3048 wrote to memory of 2924	3048	rundll32.exe	rundll32.exe
PID 3048 wrote to memory of 2924	3048	rundll32.exe	rundll32.exe
PID 3048 wrote to memory of 2924	3048	rundll32.exe	rundll32.exe
PID 3048 wrote to memory of 2924	3048	rundll32.exe	rundll32.exe
PID 3048 wrote to memory of 2924	3048	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Banner.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3048

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Banner.dll,#1
2⤵
PID:2924

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...