fb037b4fa9732946abaa8d1e052c7b848230ef6ed26b8b46d105001b9025f218 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 12:22

Sharing

Report Analysis Logs

General

Target

libemv.dll
Size

248KB
MD5

f2eab90ad9d2a2166d31216e8f935013
SHA1

13943b6c37118e3d85e4ce47e1d635526d3cb7f1
SHA256

fb037b4fa9732946abaa8d1e052c7b848230ef6ed26b8b46d105001b9025f218
SHA512

4dd05695dee21a59571878ece7e89566bd9144b91a487c5f2b0acd2a2ed26653cb90d7e6b63bd440be3af6da22a1525ba650d5cbb8a444a79844495c69f941ec
SSDEEP

3072:CeM5JRTkwAmSyRzhGQbuSmhBdPP0f3C4Jd8d6QeBevzqG/gA:CeM5fTkwAPyRTuSG+f3C0dtQw8zW

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2204	2364	rundll32.exe	28
PID 2364 wrote to memory of 2204	2364	rundll32.exe	28
PID 2364 wrote to memory of 2204	2364	rundll32.exe	28
PID 2364 wrote to memory of 2204	2364	rundll32.exe	28
PID 2364 wrote to memory of 2204	2364	rundll32.exe	28
PID 2364 wrote to memory of 2204	2364	rundll32.exe	28
PID 2364 wrote to memory of 2204	2364	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libemv.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libemv.dll,#1
  2⤵
  PID:2204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads