8e56f1c06a4020dd85da5f8caf8d8660dcddc99cffe1f745ae9cc2fec5779227 | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 12:30

Sharing

Report Analysis Logs

General

Target

NcdProp.dll
Size

19KB
MD5

5ef8494b08da187e27a9a07546783c98
SHA1

219a811a38746e9d80bed794a2d6a4d753b9aeb2
SHA256

8e56f1c06a4020dd85da5f8caf8d8660dcddc99cffe1f745ae9cc2fec5779227
SHA512

394947d265ff903fe692ccc6c1c5aff833853e08960c937f69911749faaf5c822f449383b0442f9ac69127c4d3058fc9db1ead2c26f83a05e654c7e5269b2016
SSDEEP

384:CsbDdC8Z2KHyE1aEZXXKw3YmROp31A/CirgMiCVxgxWyOvtWE:C78Z9Hyl8JYmkMFeo

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2792	1720	rundll32.exe	28
PID 1720 wrote to memory of 2792	1720	rundll32.exe	28
PID 1720 wrote to memory of 2792	1720	rundll32.exe	28
PID 1720 wrote to memory of 2792	1720	rundll32.exe	28
PID 1720 wrote to memory of 2792	1720	rundll32.exe	28
PID 1720 wrote to memory of 2792	1720	rundll32.exe	28
PID 1720 wrote to memory of 2792	1720	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NcdProp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NcdProp.dll,#1
  2⤵
  PID:2792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads