914401789c623bbfc608ce1574838a7e3e39fbbbe24c34c15483f67200942c9b | Triage

Analysis

max time kernel
1563s
max time network
1565s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13-06-2024 20:39

Sharing

Report Analysis Logs

General

Target

I386/SCHANNEL.dll
Size

139KB
MD5

9de13c8259220539d3b213c453bcbed0
SHA1

93aba9ba7425e3fe4bd2aa81c290ed309f744d0e
SHA256

798b42e7b71ecb39265f1dd0cbf242ecb4117a4e740a4175c1d06b3a3e8dfb4b
SHA512

1e22b2cb0012f3a301a4e21b782cab6b96a7d757b88890a5214ef096cb3eac9e5246d210edb8096644fb894cda3bf7d42b2df4b882eddf10c7b4de981931c9a1
SSDEEP

3072:YlnZgFP/HnH19+5UJDgV/cpFgXDNzrzQFRSup1FPtGE9FKyOjG:sCF3V9+5UDxp4Z/yYuHFlz5OS

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1632 wrote to memory of 2404	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 2404	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 2404	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 2404	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 2404	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 2404	1632	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 2404	1632	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\I386\SCHANNEL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\I386\SCHANNEL.dll,#1
  2⤵
  PID:2404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads