bf2939bf0db752c8efcd56e74602440aec6c0bd28dd7c4000924bb6f1b7c147d | Triage

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 21:43

Sharing

Report Analysis Logs

General

Target

gyddosylcs_gr/Plug/PlusCtrl.dll
Size

44KB
MD5

2ff6be529bc0a39f5320856c9ed656cf
SHA1

9a547ca773a4ae5bbb8d54a622fa2e73b27d3561
SHA256

f31da4aff146d73c6bb24f7455d534830af0e252514ec6c8524cfb2bef79becc
SHA512

9c4a7057bb8b35a0254eee5d24365b3ee1d4504ad3a2968c03af7c99d13a4210cd2a153ed666c6ca5b896be898bad48a6ca38db4f0748481d68f57a81166a357
SSDEEP

768:B1Hotzw91eJI5pVyBCySBSl76Tg/WIwtD7+9G:B1H4s9oJI5pV8SBU6gXQ+9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 1704	2232	rundll32.exe	28
PID 2232 wrote to memory of 1704	2232	rundll32.exe	28
PID 2232 wrote to memory of 1704	2232	rundll32.exe	28
PID 2232 wrote to memory of 1704	2232	rundll32.exe	28
PID 2232 wrote to memory of 1704	2232	rundll32.exe	28
PID 2232 wrote to memory of 1704	2232	rundll32.exe	28
PID 2232 wrote to memory of 1704	2232	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gyddosylcs_gr\Plug\PlusCtrl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\gyddosylcs_gr\Plug\PlusCtrl.dll,#1
  2⤵
  PID:1704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads