5c9f078e9a4f15bda5af2ed8aed826ecfd3e2af0d36458a0a582df8455a23e38 | Triage

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 09:28

Sharing

Report Analysis Logs

General

Target

GlowButton.dll
Size

18KB
MD5

beedac13f12acb12160b7f77c5d0c62c
SHA1

82fc7c198f86e40c6b90ee0e71863039c008d821
SHA256

b04d657fcd67cc8cff1085198527bde1b7a6cd77e6ca2ca555be644d6b6b0b12
SHA512

db9cf0689bb33c39d101260006abf671a9bc1346625a3f937e8a324456d8092cc52608805c7f80e2b0897f931c3dc6e8c42fe75cb05e50d735f787c36fc8bf90
SSDEEP

384:jn4zIf3R6GPysEatCOu7ppvoUbX4oB5MtvGKcSI:j4zIv4cEuCOu7bQ3oBmtLcZ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 2744	2016	rundll32.exe	28
PID 2016 wrote to memory of 2744	2016	rundll32.exe	28
PID 2016 wrote to memory of 2744	2016	rundll32.exe	28
PID 2016 wrote to memory of 2744	2016	rundll32.exe	28
PID 2016 wrote to memory of 2744	2016	rundll32.exe	28
PID 2016 wrote to memory of 2744	2016	rundll32.exe	28
PID 2016 wrote to memory of 2744	2016	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GlowButton.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\GlowButton.dll,#1
  2⤵
  PID:2744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads