e77fc25d65d476945bd21748c352e1a9cb6ef8fd19fd010d9792f371607b0cf9 | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 05:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

atmfd.dll
Size

303KB
MD5

8a6597dcfd34e6645fe0bc6e8daf3801
SHA1

17801b53b9d2445f19a71fcd349b15ceb24ae612
SHA256

e77fc25d65d476945bd21748c352e1a9cb6ef8fd19fd010d9792f371607b0cf9
SHA512

519d954668de9cae82008940ccff010102fd2a2a7704b62845e2954ffba75004cd8998da6ca8f34133b55d5f271559f51d57c4a6214ddd7d6a2b8edf0826dbd7
SSDEEP

6144:Am8jaBWlERMiN5HO3bfhuOg/0bG/Nb5IRjCybODbpP0OueCJtj0RS:AFHlEZN5HO3bf8R/0INb2RjVbODbpBQj

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2012	2364	rundll32.exe	28
PID 2364 wrote to memory of 2012	2364	rundll32.exe	28
PID 2364 wrote to memory of 2012	2364	rundll32.exe	28
PID 2364 wrote to memory of 2012	2364	rundll32.exe	28
PID 2364 wrote to memory of 2012	2364	rundll32.exe	28
PID 2364 wrote to memory of 2012	2364	rundll32.exe	28
PID 2364 wrote to memory of 2012	2364	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\atmfd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\atmfd.dll,#1
  2⤵
  PID:2012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2012-0-0x00000000001A0000-0x00000000001EF000-memory.dmp

Filesize
316KB

Download
memory/2012-2-0x00000000001A0000-0x00000000001EF000-memory.dmp

Filesize
316KB

Download
memory/2012-1-0x00000000001A0000-0x00000000001EF000-memory.dmp

Filesize
316KB

Download