cb6bb334e15093e624d5a39cac6e119515bc961ea5a1232ab4aa1f6930f21584 | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 19:18

Sharing

Report Analysis Logs

General

Target

NtfsOperate.dll
Size

136KB
MD5

6cb7703ba2b48c04ab145418b49d9f0d
SHA1

43e92850218380990a38f878e237667f8398b42c
SHA256

4768f0368a787d0de3a5b2662b72e6bfa3a158ac859c2a7ee2e2a1fed21f8fc0
SHA512

730ebbdf9c22ced0bf7b4275e8a3f72625e589a494fb21707ced5dc4ba9e11911f88259df082cc5ff14c455c60f131de5f5d41985c36f1f734f2f0418ef94c61
SSDEEP

3072:itQul439NZiYd88+HS7SPlSUmoB7pInBGM:itQul+NZiY97SPlT1iGM

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2952	2956	rundll32.exe	28
PID 2956 wrote to memory of 2952	2956	rundll32.exe	28
PID 2956 wrote to memory of 2952	2956	rundll32.exe	28
PID 2956 wrote to memory of 2952	2956	rundll32.exe	28
PID 2956 wrote to memory of 2952	2956	rundll32.exe	28
PID 2956 wrote to memory of 2952	2956	rundll32.exe	28
PID 2956 wrote to memory of 2952	2956	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NtfsOperate.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NtfsOperate.dll,#1
  2⤵
  PID:2952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2952-0-0x00000000001B0000-0x00000000001D9000-memory.dmp

Filesize
164KB

Download
memory/2952-1-0x00000000001E0000-0x00000000001F6000-memory.dmp

Filesize
88KB

Download