284a18ed393b0e60ca6fada933c6612df9862d024038c51a0ab8906ccbdcc990 | Triage

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 07:47

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/TXUninstallPlugin.dll
Size

1.1MB
MD5

28cd534fcf9d006e62cb26fc9056bc16
SHA1

500ee789ff2088fefd456c9ac8506376359a58a0
SHA256

fdd318b6b0954ce3183f6c6de90ac7a95273ac292adca12762c9a447eab34149
SHA512

19d3089f0dd3f9e6893667c61a800a6c043f90633461db6a51b3a9e2e4d410de9348e3a6ca51fd1b7df9201f36d863d4501bc0e177143c0c0e8e95b29ff45eff
SSDEEP

24576:S9c8TavrtuJwnXVIxSj2vxeXJR0tkBUks3mv:S+Dtu+VYSj2ZelsWv

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2212	2076	rundll32.exe	28
PID 2076 wrote to memory of 2212	2076	rundll32.exe	28
PID 2076 wrote to memory of 2212	2076	rundll32.exe	28
PID 2076 wrote to memory of 2212	2076	rundll32.exe	28
PID 2076 wrote to memory of 2212	2076	rundll32.exe	28
PID 2076 wrote to memory of 2212	2076	rundll32.exe	28
PID 2076 wrote to memory of 2212	2076	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\TXUninstallPlugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\TXUninstallPlugin.dll,#1
  2⤵
  PID:2212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2212-0-0x00000000744A0000-0x0000000074625000-memory.dmp

Filesize
1.5MB

Download
memory/2212-1-0x0000000074310000-0x0000000074495000-memory.dmp

Filesize
1.5MB

Download