2397ac46ad9b52de1b72d6821ce44f6fd4815ea6abe449d1b731120d1e0c5ce2 | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
12-06-2024 14:10

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/gHbMwlFrsMB.dll
Size

493KB
MD5

31eafd1f2c5bceb7761b52ea85cf6c26
SHA1

51045a6eeddc1832a9a71fe95bb746192b1bbb2b
SHA256

27e62f38be7bd86e3144888e68ae6dd3cd9afccce244825929409b4e94623dd6
SHA512

4aa675ad91e655cb36adabab706d9af07b91e1b0d71799f0a4068f02765d6010cdc15ef59eb15758e569cede0161d5e8797f4f39b7dcbfb97b95770acc18e4a8
SSDEEP

12288:WwORL0u2QfuN7N5Mf9eLB6OBOBOBOomzxNrO76nwX:bWL+QI8k4zxNrO76nwX

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2052	2288	rundll32.exe	28
PID 2288 wrote to memory of 2052	2288	rundll32.exe	28
PID 2288 wrote to memory of 2052	2288	rundll32.exe	28
PID 2288 wrote to memory of 2052	2288	rundll32.exe	28
PID 2288 wrote to memory of 2052	2288	rundll32.exe	28
PID 2288 wrote to memory of 2052	2288	rundll32.exe	28
PID 2288 wrote to memory of 2052	2288	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\gHbMwlFrsMB.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\gHbMwlFrsMB.dll,#1
  2⤵
  PID:2052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads