163139e8295e62ba0add66f042c7d6d2ccc50c5710bc355bf84b5ac7fec18b1e | Triage

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
08-06-2024 18:12

Sharing

Report Analysis Logs

General

Target

public/Ultralight.dll
Size

319KB
MD5

65a8db2d2eb9594308321da1b1b13147
SHA1

7ddf6cb23706c69164a18c89435e6b24b90cb6c1
SHA256

aa4f269c8ec29ed25aebcbc233106cffeec605cd6db90e37fd3b999f3dbd949d
SHA512

555b2024a07a8718c7267a274b040c81087291e9bf1a1076c5b28bc6ac5c026d83100bf378b0c5fe1ef59303bd39ccc8e6a69c691074a8f3be8958bcf12977d6
SSDEEP

6144:6tXBQs1m1vS31GL5iNX0fuqbZIZr5+Cy6L4:6k5S31kXkF

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 1736	2108	rundll32.exe	28
PID 2108 wrote to memory of 1736	2108	rundll32.exe	28
PID 2108 wrote to memory of 1736	2108	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\public\Ultralight.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2108 -s 124
  2⤵
  PID:1736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads