767091a7c1294e9909cf14424ba538fb3a40569d4a1cbb86ffeed199e9745328 | Triage

Analysis

max time kernel
117s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-04-2024 19:30

Sharing

Report Analysis Logs

General

Target

ref/win-x86/irecovery.dll
Size

39KB
MD5

94a50deeee318e653d74a62e03c56ea8
SHA1

c33a9871dc0734b9a308aa927cafff88b0c29d38
SHA256

c8287b85e15a4e1df220bba4d584d644963d93471be6e92e5cdd19e53bfdbdc9
SHA512

526789c01dbee989eb6a8a1c251de7087c799d1f799104c23b6422985eba1e16331ae04f926c70d485eb93805c4c01aed64d03b67e70bdf177bc9862c2e72790
SSDEEP

768:xZVdRtyNdddlSMg7tmEom5P9wofPoY7YFLrk3NWqVQ5L:xZyNdddlSMg7tmEtP2ofIryQ7

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2268 wrote to memory of 2960	2268	rundll32.exe	rundll32.exe
PID 2268 wrote to memory of 2960	2268	rundll32.exe	rundll32.exe
PID 2268 wrote to memory of 2960	2268	rundll32.exe	rundll32.exe
PID 2268 wrote to memory of 2960	2268	rundll32.exe	rundll32.exe
PID 2268 wrote to memory of 2960	2268	rundll32.exe	rundll32.exe
PID 2268 wrote to memory of 2960	2268	rundll32.exe	rundll32.exe
PID 2268 wrote to memory of 2960	2268	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ref\win-x86\irecovery.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2268

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ref\win-x86\irecovery.dll,#1
2⤵
PID:2960

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...