d7354c120009134ebe2656ff97bce5f0399567e63246a6cee25dcd76e23006df | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 17:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ispc_texcomp.dll
Size

846KB
MD5

25d5c386ed5f94c8ef30ade870ba4070
SHA1

5e6ec2a2da8f5d1bf1c95127a8619200d3a91923
SHA256

d7354c120009134ebe2656ff97bce5f0399567e63246a6cee25dcd76e23006df
SHA512

bc132b0932389ec24f42fdf619dabf235e823ab9762e5916ad40794625ab5230bcf1a2d75f9cf3a87347b05fe5fb5cf0586148bb9904d99c31e15dc015b8e617
SSDEEP

12288:E6IWO1wJ5zkRH3QgWRf1A30BBE9/6hFJh4N7p1cBCexe:9IKs9WDAo+9/6hFJu9p1mCexe

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 1748	2192	rundll32.exe	28
PID 2192 wrote to memory of 1748	2192	rundll32.exe	28
PID 2192 wrote to memory of 1748	2192	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ispc_texcomp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2192 -s 184
  2⤵
  PID:1748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads