0f95960120449aeba54a96103c366bfa8d922bc2fe72cbe0ff3565ec3ae03d42 | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 12:16

Sharing

Report Analysis Logs

General

Target

Skybound.Gecko.dll
Size

176KB
MD5

9474404c6f530a5ee95367711061accc
SHA1

f7b16468728769708e4c45380ccfb0d8414ac679
SHA256

b1330c83e87c3a7514f3fba3a210d52e7362b9647317fb15b019394cee17a0e9
SHA512

165a8009c63486b7932a137dc9e6ae512676be53664317ca6f42204a24cac35a5c3e9f4c33a06a794d1d13a98259be85f47fdc2c666081022d2f7daf685d6444
SSDEEP

3072:w7+K1snsssliZGrdpYovc2PNMY0LJMDV:w7+KanHsU2nQK

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2016	2860	rundll32.exe	28
PID 2860 wrote to memory of 2016	2860	rundll32.exe	28
PID 2860 wrote to memory of 2016	2860	rundll32.exe	28
PID 2860 wrote to memory of 2016	2860	rundll32.exe	28
PID 2860 wrote to memory of 2016	2860	rundll32.exe	28
PID 2860 wrote to memory of 2016	2860	rundll32.exe	28
PID 2860 wrote to memory of 2016	2860	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Skybound.Gecko.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Skybound.Gecko.dll,#1
  2⤵
  PID:2016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads