10a4cb7a2790344ded0513b288d0431967a44706a345f50d1b8fec8e244793d9 | Triage

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 20:16

Sharing

Report Analysis Logs

General

Target

libfreetype-6.dll
Size

451KB
MD5

69ecc2d6fc9158d9076eff16c85e1c66
SHA1

c76719103e395e928bb047bc45f780942e339c9d
SHA256

1bb7699c47f85b9ff43bab71b989a5d50da83c9204daae1108659fb0efd142f0
SHA512

bdce4bfb9dc7abac08b142ede4a82368606b3d7ccb715535b2c997e8826aa91cbc8131ef2baff7baf19d0d08463173c5373e508f5d9562ece439d05675a2d8ee
SSDEEP

6144:1yJduX41qkZCVNGdZZrI2q57e/lGOYZBZMSup1GBUyDwRCuWsEWmfD:UJO48KIzdeUOYBMhMBUoafEWm

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 2488	2892	rundll32.exe	28
PID 2892 wrote to memory of 2488	2892	rundll32.exe	28
PID 2892 wrote to memory of 2488	2892	rundll32.exe	28
PID 2892 wrote to memory of 2488	2892	rundll32.exe	28
PID 2892 wrote to memory of 2488	2892	rundll32.exe	28
PID 2892 wrote to memory of 2488	2892	rundll32.exe	28
PID 2892 wrote to memory of 2488	2892	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libfreetype-6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libfreetype-6.dll,#1
  2⤵
  PID:2488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads