20a694b2cf74788ddf00dd7b0cb8477f385e167d0b3f5872e4da996bd862a6df | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 17:15

Sharing

Report Analysis Logs

General

Target

Xpander/BpmClock3.dll
Size

71KB
MD5

cd6e9ea0003997be6a4cdf0015d35086
SHA1

0fcfa12f3b8e28656c55308b251770b0ba01ae1f
SHA256

e7898b6e6b9443933b80fbac05495eed7e543811eaf133cdef422e46b5cec010
SHA512

4981ab34cfce88e907a8390972bc78760e96ae045a8e0224d977b00920a87f6c4e53fcef8bd8688e96eb6e28430587783dd12a3cd084d83acb6ac7dd4a944400
SSDEEP

1536:Y0J0BngI5nsnuCe3D37qmluKLr29uYpQ:MMuCeLBluKLq97p

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2308	2172	rundll32.exe	28
PID 2172 wrote to memory of 2308	2172	rundll32.exe	28
PID 2172 wrote to memory of 2308	2172	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Xpander\BpmClock3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2172 -s 80
  2⤵
  PID:2308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads