209dd9c494e998a20ef1e4e8c919182751ad0465916246b467a08815a591d37b | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 09:13

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/awqcm.dll
Size

125KB
MD5

bd4a88ce594510d5c100c00dd75dceb0
SHA1

2e09b83ac1c806a37bca5fe79a972886910a3e80
SHA256

d32f5eb2d1a70638ed995eeb4f626f3ebb71e43127b9539c778ad594d0d2b29c
SHA512

0bfe7fbd6fc84202048b4bd92b8323edee6a712a256f2d26a3041ac5e64ec90de32692800151cdb7e590f3b286c893374fb8bf023c3123a7c2a4ebc8dfff2033
SSDEEP

3072:E5AHaDHVM+UgAP74ucqr2spP0wKDx9Ow+:UGCVM/cut2sxSDx0w+

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2388	2204	rundll32.exe	28
PID 2204 wrote to memory of 2388	2204	rundll32.exe	28
PID 2204 wrote to memory of 2388	2204	rundll32.exe	28
PID 2204 wrote to memory of 2388	2204	rundll32.exe	28
PID 2204 wrote to memory of 2388	2204	rundll32.exe	28
PID 2204 wrote to memory of 2388	2204	rundll32.exe	28
PID 2204 wrote to memory of 2388	2204	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\awqcm.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\awqcm.dll,#1
  2⤵
  PID:2388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads