7882e839fc528d5a8d81f85c12abde672e99e8fcb2fb3a1c9d5956a605aebdb7 | Triage

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 01:39

Sharing

Report Analysis Logs

General

Target

360Base.dll
Size

767KB
MD5

3513cccdbf86f168a8d5dfaf8ffb8042
SHA1

18b506627f4711bc4a7f43fff659caaacd1fd70c
SHA256

afdf610a735ed617c8275eaa52c46a4d465fe092e174c13073501cb8bada51af
SHA512

ab3505797f1a3669c88b6fa0c45c71b0af9803fed19c3ecd0188b2e7293ffc2d2dddc44334bd2b9ba7df85a0d977024f6a91c0c24f431c71cb353cc2c44a6fc5
SSDEEP

12288:Uevk1zGNcDIC24CWJ34g6XVcJZD4LMSVLWMSNTR+9n2IYWaKg:hvk1ze7CpD6V2BiWMaTR+grKg

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 1516	2116	rundll32.exe	28
PID 2116 wrote to memory of 1516	2116	rundll32.exe	28
PID 2116 wrote to memory of 1516	2116	rundll32.exe	28
PID 2116 wrote to memory of 1516	2116	rundll32.exe	28
PID 2116 wrote to memory of 1516	2116	rundll32.exe	28
PID 2116 wrote to memory of 1516	2116	rundll32.exe	28
PID 2116 wrote to memory of 1516	2116	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\360Base.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\360Base.dll,#1
  2⤵
  PID:1516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads