20a694b2cf74788ddf00dd7b0cb8477f385e167d0b3f5872e4da996bd862a6df | Triage

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 17:15

Sharing

Report Analysis Logs

General

Target

Xpander/Converters.dll
Size

221KB
MD5

dd289150d2c52f291a230e8c4857eb23
SHA1

74333b1cf0422b3e136d1fa033c7a1e71b3e3408
SHA256

3f5e78fbeeb7a2dffb6129ac04898097d9dae573ccaf15b77f63ced9e22a094a
SHA512

e3643d2a7e5f06e8b09755b2101a549ad2c0886e75ffba59dc98ac0b7e4a5a4523ae3b0cb19ff7c1be22792d29f552ae5169dd3be9e8b25480d7cd0eca13d893
SSDEEP

3072:u5EeCsU0MJUlPIAJKG12BxlTKYyCHy9D41Awk+xk+36VTCNHhi:8CsBMJCPIAw1Awk+UTCNHh

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1284	2240	rundll32.exe	28
PID 2240 wrote to memory of 1284	2240	rundll32.exe	28
PID 2240 wrote to memory of 1284	2240	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Xpander\Converters.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2240 -s 84
  2⤵
  PID:1284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads