d3efb7084142e12b3fe6cdb51c46c1ae643451cc73b4fff3680b307006ff0460 | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
27-04-2024 21:16

Sharing

Report Analysis Logs

General

Target

Geode.dll
Size

7.6MB
MD5

713ddaf42398df8f5a1c0bb7ec5126be
SHA1

7e3d4e5e36112d5555d89ac293bc1b854818e056
SHA256

0971845e11b3bb97b288269b87446fd0c5b5ba99748e540dd8dcd97a8b630902
SHA512

3cafe3304cf8f504b6b5a2add37a4c3cb5d841aca558e96e809ff75878a02f3234d4f5d60185b153fcb049af7f673a0c00b94faf946bbdd91333389a4d4943b8
SSDEEP

49152:ebF3sSnWuvbY1ogidgqyrFfdi3ieOak5JzBZhUlqFQ03SScIRdpfo:YJnhbY5aOaOZhU703SScIRdp

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1740 wrote to memory of 2864	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 2864	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 2864	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 2864	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 2864	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 2864	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 2864	1740	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Geode.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1740

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Geode.dll,#1
2⤵
PID:2864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads