d43d793529aa53d452cc85badf97e5aa04fe09f61d99046c655a51b31709b624 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 03:20

Sharing

Report Analysis Logs

General

Target

WindowsV5PlusUtils.dll
Size

12KB
MD5

cb46bb1be80485b8b2cb3b3593f1c8e8
SHA1

cac0f3fe558698b530568fc1be979ae5bb629c2a
SHA256

f8877af50243458325fa78e0caa3ff8a2190ecc2cc8a916d3583b40a905be038
SHA512

aa0b5da90ebf5c65d3bd10b3986ed06884ab13d5440fdc90aa55ae48069e03b527b88fc0238abdaeff6d306da93b4bcdc30b9758588c7ac4bf451713c4f72401
SSDEEP

192:JwaJVWOi064ozOjEoIX8W9itSzzuSLWYt:J7kOi06JzWEoIX8W9it4zu8WYt

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1192 wrote to memory of 2036	1192	rundll32.exe	rundll32.exe
PID 1192 wrote to memory of 2036	1192	rundll32.exe	rundll32.exe
PID 1192 wrote to memory of 2036	1192	rundll32.exe	rundll32.exe
PID 1192 wrote to memory of 2036	1192	rundll32.exe	rundll32.exe
PID 1192 wrote to memory of 2036	1192	rundll32.exe	rundll32.exe
PID 1192 wrote to memory of 2036	1192	rundll32.exe	rundll32.exe
PID 1192 wrote to memory of 2036	1192	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WindowsV5PlusUtils.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1192

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WindowsV5PlusUtils.dll,#1
2⤵
PID:2036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads