359e23843898176ccb9a66786adbbe693d9b6e3af00121710e73a6d5eb75636e | Triage

Analysis

max time kernel
4s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
23/05/2024, 14:48

Sharing

Report Analysis Logs

General

Target

gs.dog.dll
Size

3.4MB
MD5

1cbcc920a354949ca2265e90ff816963
SHA1

2c3ced7e93368ab76b9c18588f637cf27b780267
SHA256

359e23843898176ccb9a66786adbbe693d9b6e3af00121710e73a6d5eb75636e
SHA512

9a4929f538832fe796b3ef20cb5bca519b4d1d4eede2cabdeda5fe00ca46c212ce684eeaf9826b8e3a4a3270560bd0232df4ba87ff02e71ca1b7c064791426c0
SSDEEP

49152:F26UX3eP4c4waarCGI0vD58Wgg8tHdboO7+XGG4lBfa0L6WEF5cnVu6yVZTLqa4i:FnSOP4avzzvqrBVda

Score

1^/10

Malware Config

Signatures

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3076	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 3076	4944	rundll32.exe	75
PID 4944 wrote to memory of 3076	4944	rundll32.exe	75
PID 4944 wrote to memory of 3076	4944	rundll32.exe	75

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gs.dog.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\gs.dog.dll,#1
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:3076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads