221e8ed761bb45fb42c5a53b0fb1a2dd44c08766a48d5b0435507d5d198f0cac | Triage

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 08:15

Sharing

Report Analysis Logs

General

Target

MSJINT35.dll
Size

120KB
MD5

fa138d551c56a1142aab95ec823dbe0d
SHA1

af299754ea8e13fe1ae491d496b8539fc9a866f8
SHA256

4528947718a00dcd143c4e3d866e702a73d70dbaa389fc3fa77a7eb1a8796e1f
SHA512

3aa5e741a9f723bc628ef3b2695fd18cc18c222a0a6be76f93c77c9fc2603ae37355b0d82df469bc1e5cea309fafc4c3a7aa85e3a605c70f9dcbe09d93c31542
SSDEEP

1536:TEhTmxiBs29gcRBqcVb+7OEK5aHDwt+vl26MhkMIuz:ToLugBqUbIdPu

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1812 wrote to memory of 2948	1812	rundll32.exe	rundll32.exe
PID 1812 wrote to memory of 2948	1812	rundll32.exe	rundll32.exe
PID 1812 wrote to memory of 2948	1812	rundll32.exe	rundll32.exe
PID 1812 wrote to memory of 2948	1812	rundll32.exe	rundll32.exe
PID 1812 wrote to memory of 2948	1812	rundll32.exe	rundll32.exe
PID 1812 wrote to memory of 2948	1812	rundll32.exe	rundll32.exe
PID 1812 wrote to memory of 2948	1812	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MSJINT35.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1812

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MSJINT35.dll,#1
2⤵
PID:2948

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...