8b56d75369b933d12b1468863c0fd035a36e0781c928683d2e315cd05fbc05b2 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
04-06-2024 12:18

Sharing

Report Analysis Logs

General

Target

Release/Resources/UAC64.dll
Size

137KB
MD5

064e92695a1af94c39c2d1f936fa183f
SHA1

25653e3665fa5beee5f2eb4c6cece23b7b0a660a
SHA256

6de1117c5407b0e061856351da89328bf6ef3f09ca59633547b8ea095f36625f
SHA512

138f3c0fae05f342a10be4be35876c286a47020e90aea036ffd8e450a1a07ceb7d1a1a9aee53665e52ea3ae571dcd3212c6289f1650313c95ad6d9903f71d369
SSDEEP

3072:LVVTOhqDnT193DO9YXUCuEy7Yh6Jd2maK1FckPxiTn/FSGj:LyhqDnx936aX3A7g6JhIcG

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2604	2316	rundll32.exe	28
PID 2316 wrote to memory of 2604	2316	rundll32.exe	28
PID 2316 wrote to memory of 2604	2316	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Release\Resources\UAC64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\system32\cmd.exe
  cmd.exe /C "%phantombp%"
  2⤵
  PID:2604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads