96e0f2a803195e87752de63e91566dfe74b565d80e3c36efd90d85ec1b3be632 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 20:33

Sharing

Report Analysis Logs

General

Target

$TEMP/glossitis.dll
Size

72KB
MD5

38e1a078aaf0a8feea3d3a6317b6e85e
SHA1

5b35cbdd235366eac93d409e7b5cfe43db444f64
SHA256

c193d53bc725e9ddcea48506f4f48bea90e665fa145a12ac1a6d1ddd0f6e113b
SHA512

2b7987f4598d9831e3f53182117e0ca49ead034358211b8fe5ae13377d9950591bf87468c12e315caf575db82cc5d0c46f0d67059d340d4fe2543dba0bc98c35
SSDEEP

768:v3nHgLuguUvuwnoARRwgVGKwbP8/bt3k86K0V/s+qzJd+8JYK:fALnca1RRwg8KQq76S+iv+j

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 936	1960	rundll32.exe	28
PID 1960 wrote to memory of 936	1960	rundll32.exe	28
PID 1960 wrote to memory of 936	1960	rundll32.exe	28
PID 1960 wrote to memory of 936	1960	rundll32.exe	28
PID 1960 wrote to memory of 936	1960	rundll32.exe	28
PID 1960 wrote to memory of 936	1960	rundll32.exe	28
PID 1960 wrote to memory of 936	1960	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\glossitis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\glossitis.dll,#1
  2⤵
  PID:936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads