5f09de90db804401842617dddb5750c6a8d7a27edb409c91f2ef86d0198d3e58 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 05:43

Sharing

Report Analysis Logs

General

Target

postproc.dll
Size

80KB
MD5

72f3b9040826e524473b9da836a3a5e3
SHA1

2f13d40f18736bca4b6416eb39e68d0efcfbcd37
SHA256

b057f6571a95cfd35e16aae5513918ba6235ee24809e70aa63fae714468f583a
SHA512

54876221e1ee1e705142d0e717a04ec4fa911f70a05acbd0468ac85684ec7653253a1c45f577cbe7eb76520c1dbb1677007bf264e91ee5553c43428a4964c30d
SSDEEP

1536:MleonJza7THltm1JjqRXQJFg2oX9W/mxec/dUWbkOboyQGT0:TonJev/mXjqtOm2oX9W/QH/dUWbZboyS

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2356	1700	rundll32.exe	28
PID 1700 wrote to memory of 2356	1700	rundll32.exe	28
PID 1700 wrote to memory of 2356	1700	rundll32.exe	28
PID 1700 wrote to memory of 2356	1700	rundll32.exe	28
PID 1700 wrote to memory of 2356	1700	rundll32.exe	28
PID 1700 wrote to memory of 2356	1700	rundll32.exe	28
PID 1700 wrote to memory of 2356	1700	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\postproc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\postproc.dll,#1
  2⤵
  PID:2356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads