4823257b6e91618705a5f1459308365cd3392d2a5e9164e0318a5eee7173d717 | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-04-2024 01:17

Sharing

Report Analysis Logs

General

Target

NtfsOperate.dll
Size

142KB
MD5

4015f3ec3c9fa53eef85f6dbc25c4269
SHA1

5e1a0815eb3c2d2f1d0626e2efa635a4f5e331b5
SHA256

8b810489c92e468e3cafb1adbef96c6916ff9725ccbaa0f5996c41030b6d665d
SHA512

55b47553225da3ac910fac1b5baee268504d9e3215b390a43596d64286b68a404f2f04abd989aa789cd84261778f7b3f31f0cf4929453f051e310d1f96c29c1b
SSDEEP

3072:7tQul439NZiYd88+HS7SPlSUmoB7pInBGhBO:7tQul+NZiY97SPlT1iGy

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2452 wrote to memory of 3004	2452	rundll32.exe	rundll32.exe
PID 2452 wrote to memory of 3004	2452	rundll32.exe	rundll32.exe
PID 2452 wrote to memory of 3004	2452	rundll32.exe	rundll32.exe
PID 2452 wrote to memory of 3004	2452	rundll32.exe	rundll32.exe
PID 2452 wrote to memory of 3004	2452	rundll32.exe	rundll32.exe
PID 2452 wrote to memory of 3004	2452	rundll32.exe	rundll32.exe
PID 2452 wrote to memory of 3004	2452	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NtfsOperate.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2452

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NtfsOperate.dll,#1
2⤵
PID:3004

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3004-0-0x00000000001F0000-0x0000000000219000-memory.dmp

Filesize
164KB

Download
memory/3004-1-0x0000000000220000-0x0000000000236000-memory.dmp

Filesize
88KB

Download