74fbb80e9ce946d112bc393e5734ac2aa5d24ab02402140f7a817fba4aab9727 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 17:59

Sharing

Report Analysis Logs

General

Target

$TEMP/gazumps.dll
Size

6KB
MD5

f61e1bbe20b14c5f1baf9192916f3fbc
SHA1

ed5f29f943dfcdee8894077f408478e5313ae4b4
SHA256

74dc1203f77e1b7e352e13c49bd3d71a9d32ff5511e03f6c9b49f11424e2ca59
SHA512

d16ab93488dad2f6d98f566562dae76c21e1ff31ec8f65991792d77ebb8d690bda458c304feffb83d6dbaa7bd5829529b9a7fe77e10211c4aaf61d63e978b2f3
SSDEEP

96:hNRubDG4qteK8I9xkR8MglDKPis8LgrDEy42KkpWh:J4Df3Kh9xkGluPi9LIDE2rW

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 2996	1296	rundll32.exe	28
PID 1296 wrote to memory of 2996	1296	rundll32.exe	28
PID 1296 wrote to memory of 2996	1296	rundll32.exe	28
PID 1296 wrote to memory of 2996	1296	rundll32.exe	28
PID 1296 wrote to memory of 2996	1296	rundll32.exe	28
PID 1296 wrote to memory of 2996	1296	rundll32.exe	28
PID 1296 wrote to memory of 2996	1296	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\gazumps.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\gazumps.dll,#1
  2⤵
  PID:2996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads