94fef3ee9512941ff1aa4c8a951598ae67c42b71fbc047d28f3164570497d0b0 | Triage

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 03:43

Sharing

Report Analysis Logs

General

Target

EngineApiWrapper.dll
Size

174KB
MD5

e7b3a04330517223ccac06e69a19591f
SHA1

f095a99e6fecda3652203e9e45bc53b32f7017f8
SHA256

f303484b154f87be0c2d14f564b0e460caf752b1ecce53095b447ea70021bda0
SHA512

837522b5deb0e30dff0b7566050f067946335cc8ee1e4e835135bc0dbea459ba933f4dff88d18e764a11fdcbda7974ecc1c28b67ca1e0e57d54a435acd586965
SSDEEP

3072:CaXkbRmkwLAGDsN5VZj4FMB3VXf56gd3nIouCOtaJQ:s0kgOVSE6OTvOtaO

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2276	2340	rundll32.exe	28
PID 2340 wrote to memory of 2276	2340	rundll32.exe	28
PID 2340 wrote to memory of 2276	2340	rundll32.exe	28
PID 2340 wrote to memory of 2276	2340	rundll32.exe	28
PID 2340 wrote to memory of 2276	2340	rundll32.exe	28
PID 2340 wrote to memory of 2276	2340	rundll32.exe	28
PID 2340 wrote to memory of 2276	2340	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\EngineApiWrapper.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\EngineApiWrapper.dll,#1
  2⤵
  PID:2276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2276-0-0x0000000002320000-0x00000000024C4000-memory.dmp

Filesize
1.6MB

Download