9b587f0574d013ada38f6973195e0ebcb1889952370dd3396e9f89e3622ff81a | Triage

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-04-2024 01:43

Sharing

Report Analysis Logs

General

Target

FatOperate.dll
Size

129KB
MD5

66df78ec2a9cd51adcd2771d59086645
SHA1

fc71cfb7701c4f85081f1f016de2749165ad4e6c
SHA256

cf2af9307b8042283e7f69a6126dffed6138957c5e3a237ceaf9cdd63fb94c84
SHA512

dfecd8cb84d6ab6ed25b2f88b7daea53e9a8515568836f9fb8fe28f8468d17fbf81757399b5a362c94de79f706b00c05052b3cb93d8c72c1defafa0ae05b8d5c
SSDEEP

1536:STg8mPw8d4SLbmRPt4Ntxn4tBTjzHS9rck5QyuIoaGsS5yBO:SU82gkbjLprzuIoaGsSoBO

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2512 wrote to memory of 3064	2512	rundll32.exe	rundll32.exe
PID 2512 wrote to memory of 3064	2512	rundll32.exe	rundll32.exe
PID 2512 wrote to memory of 3064	2512	rundll32.exe	rundll32.exe
PID 2512 wrote to memory of 3064	2512	rundll32.exe	rundll32.exe
PID 2512 wrote to memory of 3064	2512	rundll32.exe	rundll32.exe
PID 2512 wrote to memory of 3064	2512	rundll32.exe	rundll32.exe
PID 2512 wrote to memory of 3064	2512	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FatOperate.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2512

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FatOperate.dll,#1
2⤵
PID:3064

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3064-0-0x0000000000390000-0x00000000003B9000-memory.dmp

Filesize
164KB

Download
memory/3064-1-0x00000000003C0000-0x00000000003D6000-memory.dmp

Filesize
88KB

Download