1f7f8fa2a0d1850a1753edd61fc2ddfd67031a15b65929469c044dc8c751de03 | Triage™

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 07:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/Banner.dll
Size 3KB
Sample240510-jgtryaeb32
SHA256 37f3514571476a739a26d86bf0bfb7f41f7a56fc30a9bf43f9381d0eb4df22d6
MD5 ab67c38251627bdd59af50c52deda52c
SHA1 2eaf5464a294a5c5aa77ae757893be6f59e0e087
SHA512 b9af9182d4f15cfb8547fc93ecd17aa95c2c65fe45b41c8fdb25752f54bfce397b371dae3a31e15f697047f8037c34e88daa83867d96e93cade57737c9b35afd
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 1704	1644	rundll32.exe	28
PID 1644 wrote to memory of 1704	1644	rundll32.exe	28
PID 1644 wrote to memory of 1704	1644	rundll32.exe	28
PID 1644 wrote to memory of 1704	1644	rundll32.exe	28
PID 1644 wrote to memory of 1704	1644	rundll32.exe	28
PID 1644 wrote to memory of 1704	1644	rundll32.exe	28
PID 1644 wrote to memory of 1704	1644	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Banner.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Banner.dll,#1
  2⤵
  PID:1704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads