1dff748cbad8d2b8ec94f26a90f36ff1ace5cc273c95e2aa50aa704361672f84 | Triage

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 21:53

Sharing

Report Analysis Logs

General

Target

WINSTR.dll
Size

72KB
MD5

31269ef2475300687fd75c33e39c2062
SHA1

3e77a165b339e87b67e2b14e3c7dca201cb4124d
SHA256

e6101f498c555fc1a98aa7bd5ea060a848408b78d1cc4fc0e54c81d30b2986ad
SHA512

177041feb1026c2ddc08b91f2ae6c602b0c9943c781a435b0047a0ac265e0d651fe27d059171a71795e5b4aba02017760fca37d2b783df62cdead80339ceaa57
SSDEEP

1536:6ACaKiMrTPf1UPp9fslmgJXdudkvtoWoegMt:PKZrT3yxlsIqodkvm9egMt

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1972 wrote to memory of 2520	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 2520	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 2520	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 2520	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 2520	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 2520	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 2520	1972	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WINSTR.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\WINSTR.dll,#1
  2⤵
  PID:2520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2520-1-0x0000000000280000-0x00000000002A2000-memory.dmp

Filesize
136KB

Download
memory/2520-2-0x00000000001E0000-0x00000000001FA000-memory.dmp

Filesize
104KB

Download
memory/2520-0-0x00000000001C0000-0x00000000001DD000-memory.dmp

Filesize
116KB

Download