Overview

overview

3

Static

static

3

ollydbg-sc...ec.dll

windows7-x64

1

ollydbg-sc...ec.dll

windows10-2004-x64

3

ollydbg-sc...0.1.js

windows7-x64

3

ollydbg-sc...0.1.js

windows10-2004-x64

3

ArmaDetach.dll

windows7-x64

1

ArmaDetach.dll

windows10-2004-x64

1

ArmaDetach.exe

windows7-x64

1

ArmaDetach.exe

windows10-2004-x64

1

ArmaFP.exe

windows7-x64

1

ArmaFP.exe

windows10-2004-x64

1

ArmInline.exe

windows7-x64

1

ArmInline.exe

windows10-2004-x64

1

Disasm.dll

windows7-x64

3

Disasm.dll

windows10-2004-x64

1

NanoView.exe

windows7-x64

1

NanoView.exe

windows10-2004-x64

1

Nanolib.dll

windows7-x64

3

Nanolib.dll

windows10-2004-x64

3

ArmaCRCStd.exe

windows7-x64

1

ArmaCRCStd.exe

windows10-2004-x64

1

DllLoader.exe

windows7-x64

1

DllLoader.exe

windows10-2004-x64

1

dilloDIE.exe

windows7-x64

1

dilloDIE.exe

windows10-2004-x64

1

DllLoader.exe

windows7-x64

1

DllLoader.exe

windows10-2004-x64

1

dilloDIE.exe

windows7-x64

1

dilloDIE.exe

windows10-2004-x64

1

ollydbg-sc...en.exe

windows7-x64

1

ollydbg-sc...en.exe

windows10-2004-x64

1

ollydbg-sc...ck.dll

windows7-x64

1

ollydbg-sc...ck.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    129s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/05/2024, 23:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Disasm.dll

  • Size

    32KB

  • MD5

    0a33308bcabe87a567078495b67c4872

  • SHA1

    d12ec1918ebafa31f23eebf073159ff13813c9b5

  • SHA256

    73335273537b19deb315df11299f8cd80561bc9af153c6498559a928f0bcd460

  • SHA512

    75ce679c6812836d4c91aab05c10242291cd5dbe3e0bc1c45029f8c51fd4e1b9645fc5d04eeec81a4b14bd427a69e39236868094337834cfc2919ef2c8e6dddc

  • SSDEEP

    384:8+C8MiTtP7N07cwnYBR75D7naedkQiVHcuyBSlsm58F86yxioOl6VyQ7Vko:/Zh7RwnyvnFk0lCGOI16IQ7Vko

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\Disasm.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2816
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\Disasm.dll,#1
      2⤵
        PID:2312

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads