fe4272ba86c0d5cc30c42e813e96d189d2e45044639dcb2ee69c535ea0d76c06 | Triage

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 05:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dpCoInst.dll
Size

140KB
MD5

fd7b9495eac95bb35cedc86d6060d7ff
SHA1

92abd4c69d506ad810099808c548ecf6be44ed5c
SHA256

fe4272ba86c0d5cc30c42e813e96d189d2e45044639dcb2ee69c535ea0d76c06
SHA512

6b9d9641e7389dec47c061bb842631887aae38837aea1da765314be2d923d06fad8fa81e5b364bd8a1b1258889e9a3e38ee938b98ba30263b98b68970d5ff84c
SSDEEP

3072:GaqbaFIWIjJ4T9amh7pybydG08ZVco5xPkzc0c5rarMcytw:Ga4NjJZmhgbyg0Exe

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2792	2108	rundll32.exe	28
PID 2108 wrote to memory of 2792	2108	rundll32.exe	28
PID 2108 wrote to memory of 2792	2108	rundll32.exe	28
PID 2108 wrote to memory of 2792	2108	rundll32.exe	28
PID 2108 wrote to memory of 2792	2108	rundll32.exe	28
PID 2108 wrote to memory of 2792	2108	rundll32.exe	28
PID 2108 wrote to memory of 2792	2108	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dpCoInst.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dpCoInst.dll,#1
  2⤵
  PID:2792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads