662ce2779aeca5637684558f792f43c114ff5d6dd2568c351f7cccd0dfab935c | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:35

Sharing

Report Analysis Logs

General

Target

BackendModels.dll
Size

14KB
MD5

01f030e89968f7d8bc47f7ce94296481
SHA1

0f0b7342d56e6ffdf7d813bc00ebc79b8c975482
SHA256

a0ae31e9b5b5cc90a2d9364bf233011cafbd667f2071b8fb9296fd7607136d08
SHA512

8df44a4cc580b4690fb5ebb775bbe57decb0bd86f44d4fc82f4127334b08b3941257004be4c3f03a454cea6e6cc8c86c17a3ab076f0988d8a4d815a895c2a231
SSDEEP

384:ZHa+TZxtCAlzbU1qG0sdh6pgxxLkMNbH/+xFirYWY:U+T3tzlzQxhv/+xK6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2056 wrote to memory of 2100	2056	rundll32.exe	rundll32.exe
PID 2056 wrote to memory of 2100	2056	rundll32.exe	rundll32.exe
PID 2056 wrote to memory of 2100	2056	rundll32.exe	rundll32.exe
PID 2056 wrote to memory of 2100	2056	rundll32.exe	rundll32.exe
PID 2056 wrote to memory of 2100	2056	rundll32.exe	rundll32.exe
PID 2056 wrote to memory of 2100	2056	rundll32.exe	rundll32.exe
PID 2056 wrote to memory of 2100	2056	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\BackendModels.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2056

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\BackendModels.dll,#1
2⤵
PID:2100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads