5786b7b72667b9ea1cc4bf7762a9e313c2ad1474392907a0f3b52e4e888029bf | Triage

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 12:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

SmackW32.dll
Size

93KB
MD5

985229b70d958557dfdb4498f6aeeb8a
SHA1

d85bc8a2aec0eafa35f59baa1cc9293661c7b618
SHA256

5786b7b72667b9ea1cc4bf7762a9e313c2ad1474392907a0f3b52e4e888029bf
SHA512

ea411e07ecfb29a8b4744e3873942bf7b8fad1f74703e11fdf01e6340c50e9f8f0146d8688d6852c374387d039e2b15e91b57f372a006f792cdb13ae93359efc
SSDEEP

1536:qSYrqb+H5eZLHAkCdzNZqqxRQX2xk1bBcZlMo4Of9zPolmFudoh:0LH50LgndhZqcQX2u1Vsdz0m8dO

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2900	2872	rundll32.exe	28
PID 2872 wrote to memory of 2900	2872	rundll32.exe	28
PID 2872 wrote to memory of 2900	2872	rundll32.exe	28
PID 2872 wrote to memory of 2900	2872	rundll32.exe	28
PID 2872 wrote to memory of 2900	2872	rundll32.exe	28
PID 2872 wrote to memory of 2900	2872	rundll32.exe	28
PID 2872 wrote to memory of 2900	2872	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SmackW32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SmackW32.dll,#1
  2⤵
  PID:2900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads