20a694b2cf74788ddf00dd7b0cb8477f385e167d0b3f5872e4da996bd862a6df | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 17:15

Sharing

Report Analysis Logs

General

Target

Xpander/SubControlsXp.dll
Size

272KB
MD5

295c4c0cce9ddb525225b24655c1c2a1
SHA1

ab5a1b531dee2cbe55eaaf623a75fd0132702c30
SHA256

3b56d39272feb60621404ab0fb5fe645e86ef1908b590ebca5f94e198bdf7329
SHA512

e7d2333e3817bcbd45be26aee6b9d6363650513db30336342f41571e67e0f286f7dde9aa829e7773e8ba14449f3f4046492219b5d5c35dad00f9f75529684026
SSDEEP

6144:ObUTGi6dJDoaVWwwCfPNt++0+U/jSkGoy+jT:ObzVjtj8juuT

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 360 wrote to memory of 2200	360	rundll32.exe	28
PID 360 wrote to memory of 2200	360	rundll32.exe	28
PID 360 wrote to memory of 2200	360	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Xpander\SubControlsXp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:360
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 360 -s 80
  2⤵
  PID:2200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads