b157dcfa2ba4edf1b4684663ece6562952e3a504732fc28320e0bd493fda9c67 | Triage

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 05:34

Sharing

Report Analysis Logs

General

Target

GrandDogSetup.dll
Size

940KB
MD5

01e44e1c59c7f5a8a6b8bc4f37c58047
SHA1

10234b5dd68733a6e3b823695512e4e4ea5b0f3f
SHA256

b157dcfa2ba4edf1b4684663ece6562952e3a504732fc28320e0bd493fda9c67
SHA512

8615077d2c9147a4bc9970c040147cd0703e67f82263e86b5ec28b8953cae898f71e664f75dc92dbfd84a1ae8f9559e048dc4a3757902486f510123f93f57f16
SSDEEP

24576:oj8qJC+uzMiod0+uysxwSoPdVoBjCvuF17+2NdJfGM3AV7:U8edb1RSoPdVoXGMc

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 616 wrote to memory of 1940	616	rundll32.exe	28
PID 616 wrote to memory of 1940	616	rundll32.exe	28
PID 616 wrote to memory of 1940	616	rundll32.exe	28
PID 616 wrote to memory of 1940	616	rundll32.exe	28
PID 616 wrote to memory of 1940	616	rundll32.exe	28
PID 616 wrote to memory of 1940	616	rundll32.exe	28
PID 616 wrote to memory of 1940	616	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GrandDogSetup.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:616
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\GrandDogSetup.dll,#1
  2⤵
  PID:1940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads