5de7ed06d3be633062d0a7011c3617b574c82a13ebe12946ced2eda7a07d48ec | Triage

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 19:45

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/jks.dll
Size

120KB
MD5

aca8d0928bf74e14dbbd29b97311de7b
SHA1

630f374895338fc479e56404d2d7ea3c4f3b6aa2
SHA256

75aec64705a7b46ca5d3ee8979ea34294d129beaba0632598d46c4f43a63dc6e
SHA512

84a15afac59ebb1b8ac0a2f0bd47ff7502e7d8a28322d62f118f32348da6bba2f2f4dd8f15cf2c66326593460e19aa9ce0dac275f0d891f2791ea16db3a61268
SSDEEP

1536:FonKqtLS5S7fA8VUfiYzgVR7yOvZb/oDB+u+SlnWBKZZ9LMSpcA:SK425qfAmt2EPu1aKZZ9oSp

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 552	1196	rundll32.exe	28
PID 1196 wrote to memory of 552	1196	rundll32.exe	28
PID 1196 wrote to memory of 552	1196	rundll32.exe	28
PID 1196 wrote to memory of 552	1196	rundll32.exe	28
PID 1196 wrote to memory of 552	1196	rundll32.exe	28
PID 1196 wrote to memory of 552	1196	rundll32.exe	28
PID 1196 wrote to memory of 552	1196	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\jks.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\jks.dll,#1
  2⤵
  PID:552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads