341f97e83e1ccfe0a11dc3211ae5d1211268ac63c9b6c2c778b3b4ae60864e55 | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-04-2024 09:30

Sharing

Report Analysis Logs

General

Target

15 Cable 4.0/borlndmm.dll
Size

18KB
MD5

ded1c6d9dedad4357cb852524b195e81
SHA1

1304f8c2ee6eeeee037fba24ebd081b687a4803f
SHA256

4b531ac5e9be73d2038e308c44155f559181f17c50b985ca80a99908c38fa3d5
SHA512

9569d3823c610460c1713a3598402e6ccd8912e2be3f77bae365cd65340f0a6931f7d9637fa824812e211ed1c66b8dc09c06b60dc52d1d7b810ec86250954350
SSDEEP

384:nNEWMQqKcECEDyzNwEk9UUiK6RmXBEe8m+HRiTn:eWMQqlECwyzyEtVT0Ke8ZHkL

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 856 wrote to memory of 1264	856	rundll32.exe	rundll32.exe
PID 856 wrote to memory of 1264	856	rundll32.exe	rundll32.exe
PID 856 wrote to memory of 1264	856	rundll32.exe	rundll32.exe
PID 856 wrote to memory of 1264	856	rundll32.exe	rundll32.exe
PID 856 wrote to memory of 1264	856	rundll32.exe	rundll32.exe
PID 856 wrote to memory of 1264	856	rundll32.exe	rundll32.exe
PID 856 wrote to memory of 1264	856	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\15 Cable 4.0\borlndmm.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:856

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\15 Cable 4.0\borlndmm.dll",#1
2⤵
PID:1264

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...