c7c1e87f74a0a769fed8b305ce43f926bd68e02e80f40976698366baa045b0cf | Triage

Analysis

max time kernel
142s
max time network
130s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
09-06-2024 06:58

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/System.dll
Size

24KB
MD5

47ba95323f37f91363eecfefb6bf88e4
SHA1

9a08ae3d832da3d7e1199afe3d41d45413cee854
SHA256

7c44c346cfc9ec199d3ec20dce30dfbec61f2c6c9accabd32780e449b5f7ff58
SHA512

91c85eb5daae4d3b4d9f9110db1019fb2d80407462b7dcef8dddde3500fdf0321c8d3eede19284c03c2c35f07face80023ce9dc9d3428ef5992fa67843734774
SSDEEP

384:0rkXjuy8uAl6LK3wEJKGuaR4bmeI1hp5kf43TU++++++++8d9khGKb5C:0XyAULK3re1Irfk4dgGKb

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2872	3044	rundll32.exe	28
PID 3044 wrote to memory of 2872	3044	rundll32.exe	28
PID 3044 wrote to memory of 2872	3044	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3044 -s 112
  2⤵
  PID:2872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3044-0-0x000007FEFB290000-0x000007FEFB29F000-memory.dmp

Filesize
60KB

Download