97cf70062f25b360a517a632165ac3d0f0a28de8cc332438694be046db8d349c | Triage

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 21:46

Sharing

Report Analysis Logs

General

Target

KwDataDef.dll
Size

17KB
MD5

12a3a448167d7547b5678be8ae2ef1d3
SHA1

e560f9f221facd9e94d56d911ceb0cff87de5b14
SHA256

baaa76261d1d79b77f6fda9dd2aace358f36229d5045dc32a6d6ca96e6fb1051
SHA512

4e363dc6ab1ce0e2a98ac9ef7df5fc35ce3c4c077fae9f5bf18739d8229eca3fbad6aab3d927c6c0c323f2847a5fccb2dad31f3cc96556fe896e38ead33e1bd6
SSDEEP

384:LNn8zAHdefJD+02OK/ho6mwJnYPLxukq2eM7:J9eRS02OKu6TJNm

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 1744	2244	rundll32.exe	28
PID 2244 wrote to memory of 1744	2244	rundll32.exe	28
PID 2244 wrote to memory of 1744	2244	rundll32.exe	28
PID 2244 wrote to memory of 1744	2244	rundll32.exe	28
PID 2244 wrote to memory of 1744	2244	rundll32.exe	28
PID 2244 wrote to memory of 1744	2244	rundll32.exe	28
PID 2244 wrote to memory of 1744	2244	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\KwDataDef.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\KwDataDef.dll,#1
  2⤵
  PID:1744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads