d3efb7084142e12b3fe6cdb51c46c1ae643451cc73b4fff3680b307006ff0460 | Triage

Analysis

max time kernel
122s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 22:09

Sharing

Report Analysis Logs

General

Target

XInput9_1_0.dll
Size

11KB
MD5

e7f1cc85f97c92b5eca447ed7ca7dabb
SHA1

6512719f6a0875675034e39f0cd29f435c42b008
SHA256

9e25ae49f8a2061d2c31f9c1c381010e04f7c3800f33daf47168763a2b9ccfb1
SHA512

bdd0814327a8cc14a11210745b3e9ed4def7629b32a8fa4a7ac139e1ba0238e49e057d49f4d49ac2b599dab172edbd2b1adc9ba274cc9057652abc2b5243ac46
SSDEEP

192:EQdcdW6Ss9HI23vSdZXShyWJT/BEaE+EgwijOyfaCwmPgbDLTGc:K/SspI2WgHJZlj/fa/tvi

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1280 wrote to memory of 2780	1280	rundll32.exe	rundll32.exe
PID 1280 wrote to memory of 2780	1280	rundll32.exe	rundll32.exe
PID 1280 wrote to memory of 2780	1280	rundll32.exe	rundll32.exe
PID 1280 wrote to memory of 2780	1280	rundll32.exe	rundll32.exe
PID 1280 wrote to memory of 2780	1280	rundll32.exe	rundll32.exe
PID 1280 wrote to memory of 2780	1280	rundll32.exe	rundll32.exe
PID 1280 wrote to memory of 2780	1280	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XInput9_1_0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1280

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XInput9_1_0.dll,#1
2⤵
PID:2780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads