cc5355f2d34911a2bc141dee33a792c4a36daa151c808352a32b956cdf5932ce | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 09:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

plaguepast hackvshack.net.dll
Size

9.1MB
MD5

d58c63a30e0c82dcdf83e5ec983289cd
SHA1

75c7240e060667d674fab2c8117dc3a52909c3d2
SHA256

cc5355f2d34911a2bc141dee33a792c4a36daa151c808352a32b956cdf5932ce
SHA512

7cbf60648c047bc8db2c1430bb835b28097c8a329f4c8de1e077f54f5ce7b76492c1d5ab1de23802583edc0da435c05f6b577f39642cd59220f5e394a92256ea
SSDEEP

98304:LMRV0HXaBLYm40XcyOQFgu6Q3lZ8TRbp/sbe3aNr:LMneXahJsyzx6WZQzKe

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
912	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 2088	912	rundll32.exe	28
PID 912 wrote to memory of 2088	912	rundll32.exe	28
PID 912 wrote to memory of 2088	912	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\plaguepast hackvshack.net.dll",#1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 912 -s 216
  2⤵
  PID:2088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/912-0-0x0000000002030000-0x00000000028F0000-memory.dmp

Filesize
8.8MB

Download
memory/912-1-0x0000000002030000-0x00000000028F0000-memory.dmp

Filesize
8.8MB

Download
memory/912-3-0x0000000002030000-0x00000000028F0000-memory.dmp

Filesize
8.8MB

Download
memory/912-5-0x0000000002030000-0x00000000028F0000-memory.dmp

Filesize
8.8MB

Download