25bff48681722f169b4535d7564606d13de109f529177c2f1c8f1ed2ea46412f | Triage™

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
07/06/2024, 01:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/Banner.dll
Size 4KB
Sample240607-brscvsfb4y
SHA256 e5a0972609366a4fe74d7bb69f7c5599e88a302e77eb5abd7eb653b8133f1a4c
MD5 d51eece665b6b520e69c76dcf3fd13d1
SHA1 ef725348a4bd3941eb3a21d8049dc19fa5daa14e
SHA512 cd68a91f907e901c1f3f4b7a2351fac4d33a17562b6e80dda75832ce970242d19fd42cf3c362db238c66f6dc5a8c6a8f144b04ff3286436d0ba8d0a2e3e513c3
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 2564	2752	rundll32.exe	28
PID 2752 wrote to memory of 2564	2752	rundll32.exe	28
PID 2752 wrote to memory of 2564	2752	rundll32.exe	28
PID 2752 wrote to memory of 2564	2752	rundll32.exe	28
PID 2752 wrote to memory of 2564	2752	rundll32.exe	28
PID 2752 wrote to memory of 2564	2752	rundll32.exe	28
PID 2752 wrote to memory of 2564	2752	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Banner.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Banner.dll,#1
  2⤵
  PID:2564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads