025ca9a56a4ab20702dd386fef1d2df311646fb741841cc64d70d37f84468876 | Triage

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:31

Sharing

Report Analysis Logs

General

Target

DriverInstall/LiveUpd360.dll
Size

410KB
MD5

3e6a4fb17fc307a49f9cd1bd4dc838b5
SHA1

c35455fb190aee9b4eadc5aa999340767740d29a
SHA256

7494b01c952162aad24932db3cbbbf4ec8d81825ba5a33b0a0faebeb9b94f94e
SHA512

f7d88cae3ff889ac043581e9fa358ad764ba29903d35d90ff3e314bb11cf6e6be70cca9d8d0406437bbf954ea39beaf79e95f93dd27e3380506ab582e2187f2d
SSDEEP

12288:t4wESFsoRF1UWhYItXUk7GQiA74AfAFKaI6pv1JMzd2dc:p1Rn984AAaI4NJsd2q

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2492 wrote to memory of 2488	2492	rundll32.exe	rundll32.exe
PID 2492 wrote to memory of 2488	2492	rundll32.exe	rundll32.exe
PID 2492 wrote to memory of 2488	2492	rundll32.exe	rundll32.exe
PID 2492 wrote to memory of 2488	2492	rundll32.exe	rundll32.exe
PID 2492 wrote to memory of 2488	2492	rundll32.exe	rundll32.exe
PID 2492 wrote to memory of 2488	2492	rundll32.exe	rundll32.exe
PID 2492 wrote to memory of 2488	2492	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DriverInstall\LiveUpd360.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2492

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DriverInstall\LiveUpd360.dll,#1
2⤵
PID:2488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads