20a694b2cf74788ddf00dd7b0cb8477f385e167d0b3f5872e4da996bd862a6df | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 17:15

Sharing

Report Analysis Logs

General

Target

Xpander/PatchMemory.dll
Size

171KB
MD5

dc2ee73f1b99824eb31ce51d88521dc8
SHA1

07b490db4987bad7b93a3b6a832175c7dcb2637b
SHA256

27a3107c461c96a9ab6da8a51ed9e4c4faec7685fc493184dbef7a0ee89d35ec
SHA512

9e4b8d0b43f317f2029aa1c6e925707c50fb0055fc4b9643a6d01a007b7f9ea82c67426a62ca1e1846608c13e9b100cf63c3b8f9d57d97ba164047692f2f4a23
SSDEEP

3072:rANR65o7IWEiJ6XVgxRC6s4xy8BhFA7ita:rAN37IWt6cRHXN7yic

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 1700	3056	rundll32.exe	28
PID 3056 wrote to memory of 1700	3056	rundll32.exe	28
PID 3056 wrote to memory of 1700	3056	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Xpander\PatchMemory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3056 -s 80
  2⤵
  PID:1700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads