b6138bd31f0930d6f489ac8ef0dad8333b30bcebc51c0940b19ab4cb3ffbab73 | Triage

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

YXCapture.dll
Size

607KB
MD5

5c67357fca4bbebb215b8dbf1d617300
SHA1

4e56bef46f87ede792cb8015eff59eb430896627
SHA256

96290694a953e721c87d1b30c02190598f93a77e9f58fe0c0e584d5214a3a27e
SHA512

e24bd58be87bca99f5e68096fef7a3ea067d26146142dd1e53279bbb60207783562f2d9732bb257e68b3f75a1ab46129def472e3c76f1500f92a5f0c56df98a2
SSDEEP

12288:Bl6rwCkTDoxkYbAQpJUnFDQnCWK9tmyDHdmNs:Bl6r9AKI2nCTKit

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 1192	2968	rundll32.exe	28
PID 2968 wrote to memory of 1192	2968	rundll32.exe	28
PID 2968 wrote to memory of 1192	2968	rundll32.exe	28
PID 2968 wrote to memory of 1192	2968	rundll32.exe	28
PID 2968 wrote to memory of 1192	2968	rundll32.exe	28
PID 2968 wrote to memory of 1192	2968	rundll32.exe	28
PID 2968 wrote to memory of 1192	2968	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\YXCapture.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\YXCapture.dll,#1
  2⤵
  PID:1192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads