20a694b2cf74788ddf00dd7b0cb8477f385e167d0b3f5872e4da996bd862a6df | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 17:15

Sharing

Report Analysis Logs

General

Target

Xpander/Spring2.dll
Size

71KB
MD5

031ae84de02b23a950897071f9a685cb
SHA1

6b202644354de46e3c6eb42388dee64429b5d256
SHA256

7cce9fe752e82988d52510e89ab370bb6d01eb4136ac1c03fbdd6f39570d70cf
SHA512

83bd3277aaab1f1fefc5a0e5f5c811485aade68966a59df480f634c65497acb57fe2c996ce674a16d846991d4eb23909b2eada6866e648e1d5aec7451e4438e3
SSDEEP

1536:tyZxYA3CQHNnNRSWQ2E14f+RC4rT3cRx:tyZ93/PSWQH4fr4rT

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 1992	2360	rundll32.exe	28
PID 2360 wrote to memory of 1992	2360	rundll32.exe	28
PID 2360 wrote to memory of 1992	2360	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Xpander\Spring2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2360 -s 80
  2⤵
  PID:1992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads