4823257b6e91618705a5f1459308365cd3392d2a5e9164e0318a5eee7173d717 | Triage

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-04-2024 01:17

Sharing

Report Analysis Logs

General

Target

CalcHashAB.dll
Size

1.2MB
MD5

4a94dc352cb914d12ac656ab6c3dcdc9
SHA1

4118f895b5b4c35ccae013a7d019533b1d1633eb
SHA256

a9fe821e9e56a8c7bca32b629ba936e38793a56efb118081db26565c9972344b
SHA512

06b86958acc821b42d45655b86d7a3e022be3f88f013e9aa10a9c667dd27563c871724a3df3e6cda1703e68589def53b783ddcfd4d3b24350dfe6dc0ddf26a5b
SSDEEP

24576:RRo7AfCUuKsOMmSxpeH6FzhjnQf9XPCRn:wAaULKxoH6FzhjnQ4Rn

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2176 wrote to memory of 2296	2176	rundll32.exe	rundll32.exe
PID 2176 wrote to memory of 2296	2176	rundll32.exe	rundll32.exe
PID 2176 wrote to memory of 2296	2176	rundll32.exe	rundll32.exe
PID 2176 wrote to memory of 2296	2176	rundll32.exe	rundll32.exe
PID 2176 wrote to memory of 2296	2176	rundll32.exe	rundll32.exe
PID 2176 wrote to memory of 2296	2176	rundll32.exe	rundll32.exe
PID 2176 wrote to memory of 2296	2176	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CalcHashAB.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2176

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CalcHashAB.dll,#1
2⤵
PID:2296

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2296-0-0x0000000075200000-0x0000000075375000-memory.dmp

Filesize
1.5MB

Download
memory/2296-1-0x0000000075200000-0x0000000075375000-memory.dmp

Filesize
1.5MB

Download