52a2fceb783b68c15163928a1f01f4ad9a49d48928a3e68f073eeaf1b550d3b4 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04-06-2024 20:45

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/RCPicPlugin.dll
Size

992KB
MD5

05ad7a5d251e7c7bfd9d56125663d2bd
SHA1

4e3951b8b9f7fa6e738998217938fda91fae720a
SHA256

a2bc165462b22163e5abed2725148fae55e7369e6a7c688a907db244d0115fb9
SHA512

b79d71ec6ab87405e9c6f3c524b52b57aa56aa4058d9aa8e53cd360acdb8bac6ed382f139a24c0973d01c565996e717d6d9513c5ff6bb39a09fd1f274d763e4b
SSDEEP

24576:8Ry6iPxLCbBeksw4CXWsQEC5K/e4vqLlmyA:/PxLCbBHswtVQECSeW4k

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 2488	1792	rundll32.exe	28
PID 1792 wrote to memory of 2488	1792	rundll32.exe	28
PID 1792 wrote to memory of 2488	1792	rundll32.exe	28
PID 1792 wrote to memory of 2488	1792	rundll32.exe	28
PID 1792 wrote to memory of 2488	1792	rundll32.exe	28
PID 1792 wrote to memory of 2488	1792	rundll32.exe	28
PID 1792 wrote to memory of 2488	1792	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\RCPicPlugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\RCPicPlugin.dll,#1
  2⤵
  PID:2488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads