20a694b2cf74788ddf00dd7b0cb8477f385e167d0b3f5872e4da996bd862a6df | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 17:15

Sharing

Report Analysis Logs

General

Target

Xpander/Inverter.dll
Size

57KB
MD5

8d5c201d7760f2e37c9728c20eaecac7
SHA1

bfbff4b87ff387cf191caf839aa4fa66bf2fffe6
SHA256

41fe4fe01ea190d7f32798a54ba0b0287739ae1c8965a9a4fea36f290d90b3b2
SHA512

001c84aabe21f88648277f07b52da6d8925f0ceecbdbdd3150b00a347d65beae6d3c8f6d7357b4de3c70f39cbab2e0aca9c907781390e838a433d628e1f72d89
SSDEEP

768:xxl0YgD9ABInmzxQ11TeDXDdMyVqU8eSiyT8MzfXI0eGzQ1kH:vJgJqInwx8IddspIfIIkH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 308	2880	rundll32.exe	28
PID 2880 wrote to memory of 308	2880	rundll32.exe	28
PID 2880 wrote to memory of 308	2880	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Xpander\Inverter.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2880 -s 80
  2⤵
  PID:308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads