f38d5a714aca773568eb1c77492d09353cf060ddafb86b04dd6e090c09b985b3 | Triage

Resubmissions

10/05/2024, 05:18

240510-fzlbqsdb8t 8

10/05/2024, 05:13

240510-fwsawach91 3

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 05:13

Sharing

Report Analysis Logs

General

Target

Devices/MVVM.dll
Size

18KB
MD5

808df08b72dd24509c6575b77c4b67d2
SHA1

a9c47488d7b5dedbf833cd7118a1e43d9b4107e0
SHA256

11cb9ebec7b7e1ecf52aae175943223625deb57e9aedc84a0092e80bd473682c
SHA512

c879ca8e55a3a910e3c83e9d2c24840e303e81314c41926310fbde271dd742222e026cae2df43adb504d2c8ec4f303b6d74f3273e1b5d31969767866d8d1b23c
SSDEEP

384:Z44Yq1hX0q8Ifc1beosTSI7WZali5AAly9mbgz7za:m4YqbX014fhBAly9Wh

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2720	2220	rundll32.exe	28
PID 2220 wrote to memory of 2720	2220	rundll32.exe	28
PID 2220 wrote to memory of 2720	2220	rundll32.exe	28
PID 2220 wrote to memory of 2720	2220	rundll32.exe	28
PID 2220 wrote to memory of 2720	2220	rundll32.exe	28
PID 2220 wrote to memory of 2720	2220	rundll32.exe	28
PID 2220 wrote to memory of 2720	2220	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Devices\MVVM.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Devices\MVVM.dll,#1
  2⤵
  PID:2720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads