64e167683e619a5c5bb9e13852cd1908ddebc7505f4074f53327b48d14538f1f | Triage

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
29-04-2024 12:53

Sharing

Report Analysis Logs

General

Target

IP.dll
Size

89KB
MD5

38ed71d99dd2bb013c4bc8e065d87e3e
SHA1

e11be1e6647911705a90ec0f55787d2dba3e6ca0
SHA256

286069d12c8f12a00aef558d02426dfdbe3a6337b05dea53b70a3d3cfcf49ff9
SHA512

0480789002f9dd3bc52e49eb534471ab1db81be9fd94522373d14a81735aea7e20a995748edc131b0ec6ba49b420c56a030e955cffdb45ba410392dc7a8c0983
SSDEEP

1536:N+/uD66eFQO8mxmi3dFDhoKAWZbpHDd6wW/YPHb5rgakGRbiTfWS4t2Ag35DkLg8:N+ao3n2I6wW/YPb1DOTfWS0VgpJ8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2924 wrote to memory of 2132	2924	rundll32.exe	rundll32.exe
PID 2924 wrote to memory of 2132	2924	rundll32.exe	rundll32.exe
PID 2924 wrote to memory of 2132	2924	rundll32.exe	rundll32.exe
PID 2924 wrote to memory of 2132	2924	rundll32.exe	rundll32.exe
PID 2924 wrote to memory of 2132	2924	rundll32.exe	rundll32.exe
PID 2924 wrote to memory of 2132	2924	rundll32.exe	rundll32.exe
PID 2924 wrote to memory of 2132	2924	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\IP.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2924

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\IP.dll,#1
2⤵
PID:2132

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...