914401789c623bbfc608ce1574838a7e3e39fbbbe24c34c15483f67200942c9b | Triage

Analysis

max time kernel
1561s
max time network
1563s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13-06-2024 20:39

Sharing

Report Analysis Logs

General

Target

I386/DBGHELP.dll
Size

159KB
MD5

13fbc2e8b37ddf28181dd6d8081c2b8e
SHA1

af2497bd9a3898676cd9d88501bc158ce6a6f3ec
SHA256

a29056a9810ff08c708505f1ac20d0263d5d894a223696e20217c0e9d132bf84
SHA512

7cca7f8edc3dd920637e5c68f1182859810f17a1dfd72ee4f8eb28710d8d5cb866702bc0b7f4c6c03d2f35a6e58ef4b85bb7447e3abf680903c012b3ecc36692
SSDEEP

3072:Auz1eSF/ESha3EwSefyXggOkD7MV9IwZbb6ICDpQWh7HfO3:A5SFsTSefyX+9I/+C7/

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2852 wrote to memory of 2868	2852	rundll32.exe	rundll32.exe
PID 2852 wrote to memory of 2868	2852	rundll32.exe	rundll32.exe
PID 2852 wrote to memory of 2868	2852	rundll32.exe	rundll32.exe
PID 2852 wrote to memory of 2868	2852	rundll32.exe	rundll32.exe
PID 2852 wrote to memory of 2868	2852	rundll32.exe	rundll32.exe
PID 2852 wrote to memory of 2868	2852	rundll32.exe	rundll32.exe
PID 2852 wrote to memory of 2868	2852	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\I386\DBGHELP.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\I386\DBGHELP.dll,#1
  2⤵
  PID:2868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads