d80f9618ef8369e54986f2abf564e5eeccf961d3ddaca515622412b1e4648d4c | Triage

Resubmissions

20-04-2024 17:13

240420-vrrwwadh2z 10

12-03-2024 21:36

240312-1f3f5adc57 10

10-03-2024 04:41

240310-fbmjwscd28 10

10-03-2024 04:40

240310-fan2bscc93 10

10-03-2024 04:38

240310-e9wd1scc82 10

09-03-2024 07:38

240309-jghpnsdh88 10

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 17:13

Sharing

Report Analysis Logs

General

Target

Reaper/Reaper/injector.dll
Size

19KB
MD5

a4db6b21f7398882100909f37c1067a4
SHA1

7b2a61d09e4959f4578b556196a8405a2f6e45f3
SHA256

d986554d185d3f4e827a1287322210ff6a143ed723d203efbf00a8757aa13714
SHA512

42bafe3ef80a748db64dfc88a159a06ee33cecb3f709f01d9c1a9e38d3ab81008f3226963c1c2e926f5e4b6e9442fd2f8a89b0fa5425d04db869cf7be7bddd31
SSDEEP

384:5xE24iKOgW7+uPOxQkWWma3NCx7cTuOJ9jIwq6Am:5JVKVxPXWWmgIx7cKOEZFm

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2524 wrote to memory of 2184	2524	rundll32.exe	rundll32.exe
PID 2524 wrote to memory of 2184	2524	rundll32.exe	rundll32.exe
PID 2524 wrote to memory of 2184	2524	rundll32.exe	rundll32.exe
PID 2524 wrote to memory of 2184	2524	rundll32.exe	rundll32.exe
PID 2524 wrote to memory of 2184	2524	rundll32.exe	rundll32.exe
PID 2524 wrote to memory of 2184	2524	rundll32.exe	rundll32.exe
PID 2524 wrote to memory of 2184	2524	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Reaper\Reaper\injector.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2524

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Reaper\Reaper\injector.dll,#1
2⤵
PID:2184

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...