7ba7d11ece7e85cb9f0978678d74ddeb5bf57c1660df5a149937403a602a7f5d | Triage

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 02:59

Sharing

Report Analysis Logs

General

Target

data/meterpreter/ext_server_espia.x64.dll
Size

199KB
MD5

56f8f3232cddabc308e6ea2ffb6f8d80
SHA1

0480395ffd07280f5008a988ea98bf611885ad66
SHA256

1c5d0745e850f8269ed23e2131f2b1c59090dfcaab8bd63c4eddf13fd85a5f9d
SHA512

bf24a4570f73c0ac7744dde1e4e440ab557047cd063f68e959e5ed961bc92b52fff554650ac029c5762f1f3f58eed39f621279bae0f76853c9113ee9f412f159
SSDEEP

6144:V43ggA45AVlj6AENhib0WPn1TUaMws/1IancTGx/c:wAtKobfP+aB3ZC

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 2256	2768	rundll32.exe	28
PID 2768 wrote to memory of 2256	2768	rundll32.exe	28
PID 2768 wrote to memory of 2256	2768	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\data\meterpreter\ext_server_espia.x64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2768 -s 136
  2⤵
  PID:2256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads