341f97e83e1ccfe0a11dc3211ae5d1211268ac63c9b6c2c778b3b4ae60864e55 | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
25-04-2024 09:30

Sharing

Report Analysis Logs

General

Target

15 Cable 4.0/delphimm.dll
Size

16KB
MD5

81d2ffe79f3ed74c566bfab3fe7cc568
SHA1

ef17498f97617332a82f77aee339cec39411656c
SHA256

7f52a059ee54d49d5e9a0096d4e0f1e7327b2cdaee79089fb466c5d5d4cb143c
SHA512

633ecd5ed8eefd82f27c2f7a96ad0d90b7faf30e0769da8a9e2f58e1bec3d84b81cd07cc32fbfad5057d3d7f4bab06dc663bc5a751d0129c7ce5b1764d110d9b
SSDEEP

384:sEkm4qadaEOPOiHNXTD6nIhjLSCmXBEeqGuFtW:Um4qsaEOmiHNDD6IFLS3KeqGI

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2932 wrote to memory of 3020	2932	rundll32.exe	rundll32.exe
PID 2932 wrote to memory of 3020	2932	rundll32.exe	rundll32.exe
PID 2932 wrote to memory of 3020	2932	rundll32.exe	rundll32.exe
PID 2932 wrote to memory of 3020	2932	rundll32.exe	rundll32.exe
PID 2932 wrote to memory of 3020	2932	rundll32.exe	rundll32.exe
PID 2932 wrote to memory of 3020	2932	rundll32.exe	rundll32.exe
PID 2932 wrote to memory of 3020	2932	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\15 Cable 4.0\delphimm.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2932

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\15 Cable 4.0\delphimm.dll",#1
2⤵
PID:3020

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...