fcadf0a0a2c90421f3b2b67f4649eabec2d0c8d4dda9127c7621de4ae052f09d | Triage

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
22-04-2024 02:06

Sharing

Report Analysis Logs

General

Target

RecoveryPhoto.dll
Size

499KB
MD5

950ea2275b63d8bcf2eea6d593e02c87
SHA1

e4a08dcba390b0e9231adbd4624e23bb8fbaf98c
SHA256

2e9c125f510d27f09513ed8c809cff8deb5efb618379bc458ef97982aa133b52
SHA512

c66ef0e5ac444996e7f49c1ef638b7a8153c8dca4a6dd527fdbd93437164f6172cd651101e625a9dcaa4bb66bd37c31f854a872ea05bce59782d4dadea395a19
SSDEEP

12288:W6Kv0ihp+FDgzWxr8UfbHBLEOrKiEhv7evvpJII/ZE:ghhp4DgCOH0vvpJe

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3020 wrote to memory of 3040	3020	rundll32.exe	rundll32.exe
PID 3020 wrote to memory of 3040	3020	rundll32.exe	rundll32.exe
PID 3020 wrote to memory of 3040	3020	rundll32.exe	rundll32.exe
PID 3020 wrote to memory of 3040	3020	rundll32.exe	rundll32.exe
PID 3020 wrote to memory of 3040	3020	rundll32.exe	rundll32.exe
PID 3020 wrote to memory of 3040	3020	rundll32.exe	rundll32.exe
PID 3020 wrote to memory of 3040	3020	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\RecoveryPhoto.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3020

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\RecoveryPhoto.dll,#1
2⤵
PID:3040

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3040-0-0x0000000074710000-0x00000000747BF000-memory.dmp

Filesize
700KB

Download
memory/3040-1-0x0000000074700000-0x00000000747AF000-memory.dmp

Filesize
700KB

Download
memory/3040-2-0x0000000074660000-0x000000007470F000-memory.dmp

Filesize
700KB

Download