1234fca475092501d14959a1150d53c1817759cfb3960376640065467590cd66 | Triage

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 07:38

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/webapphost.dll
Size

827KB
MD5

4dc5c6692260f2191e1573dd1cb1bb32
SHA1

de77124c49f17798d2b576add2e1857515c35e10
SHA256

59f4916771a03fd9836df92196b31256c428fb50a287474359a55dcf03d32632
SHA512

9ab8135c7081487c8f9cca70bdb275553e722ac69aa1906af83657eb0ea8459feb0030e3417edff6abd1cce7ee06fc967babbd306e79911f767935db00fa549d
SSDEEP

24576:3AmjnnyOl5EdSjPWWTGprfljVrLjWf7IeMVXlPjF9J:3BpPWWTGhljVrLif7IeMVVZ9J

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 948 wrote to memory of 1676	948	rundll32.exe	rundll32.exe
PID 948 wrote to memory of 1676	948	rundll32.exe	rundll32.exe
PID 948 wrote to memory of 1676	948	rundll32.exe	rundll32.exe
PID 948 wrote to memory of 1676	948	rundll32.exe	rundll32.exe
PID 948 wrote to memory of 1676	948	rundll32.exe	rundll32.exe
PID 948 wrote to memory of 1676	948	rundll32.exe	rundll32.exe
PID 948 wrote to memory of 1676	948	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\webapphost.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:948

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\webapphost.dll,#1
2⤵
PID:1676

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...