0d4e910847a8da89c1a61e75ddd8db232083e735486178457c547e6a3958dcc1 | Triage

Analysis

max time kernel
123s
max time network
134s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 10:21

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/chkm.dll
Size

74KB
MD5

3b8308f1dba641b49a642fa6d92f3451
SHA1

a11164e08bd9c594b6d608c51a2428a4c6b555a2
SHA256

2061a94b4d34a77f935f95a3741f917c91b27d0e1585c2ee2f8e00806b671db7
SHA512

dc089fc2bb43ccfcca8748013636e8d249cd91e1b08b30358d00df0decaec5782d2af85274e7b70784d4e58c934dfe5112fdcb4006de2a5dbe9c76dae9ed1f81
SSDEEP

768:9elCeN9djBHTUURm58yTOM30Hz6pW+QLqr69p4R1t8iKkEL:9elD9djBYqyTOS0T6UBLNWt8iC

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

2188 rundll32.exe
2188 rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1740 wrote to memory of 2188	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 2188	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 2188	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 2188	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 2188	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 2188	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 2188	1740	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\chkm.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1740

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\chkm.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2188

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...