bdf12f345723570c360abae3054efab0aa3924ee471a54ab1bf8d3553f27cb2c | Triage

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 12:59

Sharing

Report Analysis Logs

General

Target

libpangoft2-1.0-0.dll
Size

65KB
MD5

800be01f6d5aa04e3efe28edc03f9fef
SHA1

1a0e9619f52445fef2a0802f3c2cc1f44c989c5d
SHA256

bdf12f345723570c360abae3054efab0aa3924ee471a54ab1bf8d3553f27cb2c
SHA512

6600c93f02f05f3036652600578db6b884b373076a9f0e5d949dc24f77c579649a83437223236f2559adb89de2de08c4976428c5f587bab4ed444c8dcd8cef96
SSDEEP

1536:kcgl0Tw0/vpneSjY1oPeDDGDsnWlUGzj:k6wAn61oPeDDGIWlUGv

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 1624	2612	rundll32.exe	28
PID 2612 wrote to memory of 1624	2612	rundll32.exe	28
PID 2612 wrote to memory of 1624	2612	rundll32.exe	28
PID 2612 wrote to memory of 1624	2612	rundll32.exe	28
PID 2612 wrote to memory of 1624	2612	rundll32.exe	28
PID 2612 wrote to memory of 1624	2612	rundll32.exe	28
PID 2612 wrote to memory of 1624	2612	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libpangoft2-1.0-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libpangoft2-1.0-0.dll,#1
  2⤵
  PID:1624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads