fcadf0a0a2c90421f3b2b67f4649eabec2d0c8d4dda9127c7621de4ae052f09d | Triage

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-04-2024 02:06

Sharing

Report Analysis Logs

General

Target

NtfsOperate.dll
Size

142KB
MD5

9a2c38fb4c5708dbaf993381ef55f62f
SHA1

7884d9af471c20300368eb7ff4d9857fbe820555
SHA256

a0d04edda568eb6b9b1979270c6b8efcb0e18049a53b1cabd9e1e96644cf8d4d
SHA512

1dcbfaef1bda69047e16c3518c7ad4cfefe1ccd3f71e2c87fa30c786f86a2f26b572a19ead670c42457d2712b801a6cdfe5c3ce8019674b24997f642f9912790
SSDEEP

3072:gtQul439NZiYd88+HS7SPlSUmoB7pInBGhBu:gtQul+NZiY97SPlT1iGS

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 544 wrote to memory of 1924	544	rundll32.exe	rundll32.exe
PID 544 wrote to memory of 1924	544	rundll32.exe	rundll32.exe
PID 544 wrote to memory of 1924	544	rundll32.exe	rundll32.exe
PID 544 wrote to memory of 1924	544	rundll32.exe	rundll32.exe
PID 544 wrote to memory of 1924	544	rundll32.exe	rundll32.exe
PID 544 wrote to memory of 1924	544	rundll32.exe	rundll32.exe
PID 544 wrote to memory of 1924	544	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NtfsOperate.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:544

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NtfsOperate.dll,#1
2⤵
PID:1924

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1924-0-0x0000000000190000-0x00000000001B9000-memory.dmp

Filesize
164KB

Download
memory/1924-1-0x0000000000130000-0x0000000000146000-memory.dmp

Filesize
88KB

Download