10a4cb7a2790344ded0513b288d0431967a44706a345f50d1b8fec8e244793d9 | Triage

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 20:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

SDL_ttf.dll
Size

26KB
MD5

7140c1835488a94eebac9d848120488e
SHA1

4a7164e99fedb7f8fc7487908688efba892afe1b
SHA256

2e92d22ed9299fd0646bc4d3799bfa7dcf7d3d5aff16107a4a836eacaed2a524
SHA512

5a22673fe787cf03385eb399307480c7e11498818b474316b13e912ceb8a1b27c1dfbfbcde2f91d345ad8cca7d4b9966e462bcdefa4fe1cbc3f6879a5fb14da8
SSDEEP

384:xjmeFtKJqdJkjYQTTkSfLqS91fPC4krpi7Mxe6a8Vg3u:xjKJ03QvkSfLqOA072xV

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2604	3048	rundll32.exe	28
PID 3048 wrote to memory of 2604	3048	rundll32.exe	28
PID 3048 wrote to memory of 2604	3048	rundll32.exe	28
PID 3048 wrote to memory of 2604	3048	rundll32.exe	28
PID 3048 wrote to memory of 2604	3048	rundll32.exe	28
PID 3048 wrote to memory of 2604	3048	rundll32.exe	28
PID 3048 wrote to memory of 2604	3048	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SDL_ttf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SDL_ttf.dll,#1
  2⤵
  PID:2604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads