b480c87b61c8af8b3141af262d0b82aad50aa21cf0f003089fa58dd49eef856b | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
02-05-2024 05:22

Sharing

Report Analysis Logs

General

Target

config.dll
Size

1.4MB
MD5

34c92b1d14219cf9479fd259cc7f47b6
SHA1

7bf294f26542c896408b7efa9e5d2060a667f6ef
SHA256

fd3f9cf8d07a29cee9c5ec0700d04bc74795e002dc890b51603dccd80ca27461
SHA512

3fae5879ac0f53ef2caa336069a85783efd196904fb38be5a498a37859e92179155ef43c6a2fbc91b49c6b98e9305fb1930012d82de4ce1e65d9a941451c659f
SSDEEP

24576:Ge7QnYLI/oMmx0DbDKrttQqcz/js8Yk2Z4Sy0VHt4LOD65AxQ:cnYNEbDs3JL8Ykk4Sy0VHmpuxQ

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config.ini	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2972	2748	rundll32.exe	28
PID 2748 wrote to memory of 2972	2748	rundll32.exe	28
PID 2748 wrote to memory of 2972	2748	rundll32.exe	28
PID 2748 wrote to memory of 2972	2748	rundll32.exe	28
PID 2748 wrote to memory of 2972	2748	rundll32.exe	28
PID 2748 wrote to memory of 2972	2748	rundll32.exe	28
PID 2748 wrote to memory of 2972	2748	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\config.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\config.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:2972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads