e0ab6ef803903b6866fb2dcddf7352e06fedc088a2b8314f7829cc9f83f2a22e | Triage

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ActiveBand.dll
Size

45KB
MD5

c36a5f6b5582d5fd6c9c19c1bc6b8b1d
SHA1

77ac565efff47b2d8995598f01e119627c144661
SHA256

c6d35a6d689d92cffc29f71a9472fb7244982a6f4ccc4e51d4aca1441045ae17
SHA512

3f35960cd3076021366f3c195269a5a2c0400b0fbce48402d96a68ce240d24752df1537809bea4220c30580ba26be5cb78d8ce741a7823a4923d23dba5b405ab
SSDEEP

768:qrG8rd9MSG/Z+xunR4BkE4KmMgUI8B1pdxlZquS2aebx/+JYBIB1sh3EJ:oG8rjjG/Z+xuR434JoY+hU

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 2188	1584	rundll32.exe	28
PID 1584 wrote to memory of 2188	1584	rundll32.exe	28
PID 1584 wrote to memory of 2188	1584	rundll32.exe	28
PID 1584 wrote to memory of 2188	1584	rundll32.exe	28
PID 1584 wrote to memory of 2188	1584	rundll32.exe	28
PID 1584 wrote to memory of 2188	1584	rundll32.exe	28
PID 1584 wrote to memory of 2188	1584	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ActiveBand.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ActiveBand.dll,#1
  2⤵
  PID:2188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2188-0-0x0000000000140000-0x000000000014F000-memory.dmp

Filesize
60KB

Download