134c5d1acefee78416ad78742e402a3992bf3ab31ce21a7c3bf07cf4e182ef22 | Triage

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 16:11

Sharing

Report Analysis Logs

General

Target

Modules/ArSp.dll
Size

38KB
MD5

c7147f4c8432b235801efcce5ce6cc4b
SHA1

0a212712de818ee6b6347a69788c628a1ad97a5f
SHA256

dd5b037412d20d8d316c1f1c937291275bb78394c47e97c1cc3c284e801ac9df
SHA512

1820fb4def4b075c991f97fb14bd8ad040ce78ca28eb418c5d2a45dd50ef98d8f73191b830388e8339b44f0daa7ef3e77b119c7efd09766fd935078a6274980a
SSDEEP

768:u/PidxjnQyslT/9wtRBYzNjMLwYFScciM:6PidtnPgr9wOzNoMYFS3iM

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 3024	2968	rundll32.exe	28
PID 2968 wrote to memory of 3024	2968	rundll32.exe	28
PID 2968 wrote to memory of 3024	2968	rundll32.exe	28
PID 2968 wrote to memory of 3024	2968	rundll32.exe	28
PID 2968 wrote to memory of 3024	2968	rundll32.exe	28
PID 2968 wrote to memory of 3024	2968	rundll32.exe	28
PID 2968 wrote to memory of 3024	2968	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Modules\ArSp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Modules\ArSp.dll,#1
  2⤵
  PID:3024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads