a990c3f49d68d4fa59c91948f939a644cf0fe305c5ead873073c886c4d581de2 | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:37

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/SetupPlugin.dll
Size

1.7MB
MD5

2fe9facfec8049c3f97dd6977cb8846b
SHA1

c807d52e7f94d7cb23ef780ce24341b5ec9cbfed
SHA256

4386761694d62ec93a19d344add5800a54c3cbfba1724331cc05c0a1b749a087
SHA512

a5b22a8b93acffb91dea1e88f1e7f20e0e4994e4f71e54dd4b07dc825345fc6445e6d008b89fee0f736a0e987136f56703a1bc84aa94b7523bd17da274ecea99
SSDEEP

49152:wFe3dzgYlOX5VxXgjUKS6pCgrsqx1vTGtotQ:plOX5VxQYKS6pZIdo

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2932 wrote to memory of 3020	2932	rundll32.exe	rundll32.exe
PID 2932 wrote to memory of 3020	2932	rundll32.exe	rundll32.exe
PID 2932 wrote to memory of 3020	2932	rundll32.exe	rundll32.exe
PID 2932 wrote to memory of 3020	2932	rundll32.exe	rundll32.exe
PID 2932 wrote to memory of 3020	2932	rundll32.exe	rundll32.exe
PID 2932 wrote to memory of 3020	2932	rundll32.exe	rundll32.exe
PID 2932 wrote to memory of 3020	2932	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SetupPlugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2932

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SetupPlugin.dll,#1
2⤵
PID:3020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads