27694908dbdcf9b68fe26c65140c22da7068c2ebd154db13d2eb1571f9153ede | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 21:15

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/ThreeCheckBoxListDll.dll
Size

181KB
MD5

8f916605c3a55e511b9e2aa3553074e2
SHA1

715e57cfc48fe7e195629b392153652346deb347
SHA256

1dd6be228b2d093b6c2d140be783fe3707760518a42ddd624da0fd7f3e206073
SHA512

c6daf882b9a160c3aa08261c9a7c8ace45e592bf33adc97f4ba41274c6d3aa56635ccc8e9f773befb3dcc6523a7eccb589da9195178102a52e7d809eb5bef963
SSDEEP

3072:XXUQ3ZVOfbjAaVhU7d5pDNN5IrKSNJlFmLqJIffM/GWxH+:NbOf3AaHqPw2O+

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 2132	1216	rundll32.exe	28
PID 1216 wrote to memory of 2132	1216	rundll32.exe	28
PID 1216 wrote to memory of 2132	1216	rundll32.exe	28
PID 1216 wrote to memory of 2132	1216	rundll32.exe	28
PID 1216 wrote to memory of 2132	1216	rundll32.exe	28
PID 1216 wrote to memory of 2132	1216	rundll32.exe	28
PID 1216 wrote to memory of 2132	1216	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ThreeCheckBoxListDll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ThreeCheckBoxListDll.dll,#1
  2⤵
  PID:2132

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads