15b640ffd99f38bce5195437a561af697a367fffffae5f6ebbddee7cfa2cf821 | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 02:04

Sharing

Report Analysis Logs

General

Target

xpsupport.dll
Size

1.2MB
MD5

4003e34416ebd25e4c115d49dc15e1a7
SHA1

faf95ec65cde5bd833ce610bb8523363310ec4ad
SHA256

c06430b8cb025be506be50a756488e1bcc3827c4f45158d93e4e3eeb98ce1e4f
SHA512

88f5d417377cd62bde417640a79b6ac493e80f0c8b1f63a99378a2a67695ef8e4a541cedb91acfa296ed608e821fee466983806f0d082ed2e74b0cd93eb4fb84
SSDEEP

24576:9AkmijauMug/iyFzb2DfsPV8A4C2vNI1cPdf8xZLGNfav9T:9WiOuRg/iyFzb2QN83XfeYaZ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2740 wrote to memory of 1176	2740	rundll32.exe	rundll32.exe
PID 2740 wrote to memory of 1176	2740	rundll32.exe	rundll32.exe
PID 2740 wrote to memory of 1176	2740	rundll32.exe	rundll32.exe
PID 2740 wrote to memory of 1176	2740	rundll32.exe	rundll32.exe
PID 2740 wrote to memory of 1176	2740	rundll32.exe	rundll32.exe
PID 2740 wrote to memory of 1176	2740	rundll32.exe	rundll32.exe
PID 2740 wrote to memory of 1176	2740	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\xpsupport.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2740

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\xpsupport.dll,#1
2⤵
PID:1176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads