d3efb7084142e12b3fe6cdb51c46c1ae643451cc73b4fff3680b307006ff0460 | Triage

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27-04-2024 21:16

Sharing

Report Analysis Logs

General

Target

XInput9_1_0.dll
Size

11KB
MD5

e7f1cc85f97c92b5eca447ed7ca7dabb
SHA1

6512719f6a0875675034e39f0cd29f435c42b008
SHA256

9e25ae49f8a2061d2c31f9c1c381010e04f7c3800f33daf47168763a2b9ccfb1
SHA512

bdd0814327a8cc14a11210745b3e9ed4def7629b32a8fa4a7ac139e1ba0238e49e057d49f4d49ac2b599dab172edbd2b1adc9ba274cc9057652abc2b5243ac46
SSDEEP

192:EQdcdW6Ss9HI23vSdZXShyWJT/BEaE+EgwijOyfaCwmPgbDLTGc:K/SspI2WgHJZlj/fa/tvi

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2056 wrote to memory of 2984	2056	rundll32.exe	rundll32.exe
PID 2056 wrote to memory of 2984	2056	rundll32.exe	rundll32.exe
PID 2056 wrote to memory of 2984	2056	rundll32.exe	rundll32.exe
PID 2056 wrote to memory of 2984	2056	rundll32.exe	rundll32.exe
PID 2056 wrote to memory of 2984	2056	rundll32.exe	rundll32.exe
PID 2056 wrote to memory of 2984	2056	rundll32.exe	rundll32.exe
PID 2056 wrote to memory of 2984	2056	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XInput9_1_0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2056

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XInput9_1_0.dll,#1
2⤵
PID:2984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads