5ac959e5dee9884512f4a34623bbad2c08be427669015b917a750f7cbfbb0a75 | Triage

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 06:53

Sharing

Report Analysis Logs

General

Target

Plugins/InputText.dll
Size

23KB
MD5

d4a3ccfa86889eca3b7cb333e33257ac
SHA1

2a0b39115b1d20457c67e082ff32d84e61ebb26b
SHA256

f35770dde8d01b7e10f969aa1202155b8b0bed9c29c4f8b40d7e683ebe73d0ab
SHA512

65ed0b36cb181b75478b50d5880e7301dd32c8933fc43d95a346a49b9fe69d8efd7bb67719e030ea79079034b7d04737fa12ebd4ba08299169a44ee03769ca1e
SSDEEP

384:ALTJ6I2BatWSdduVbdJjgaseXPG69d4NjU7J:AvJ6/atWSdYM+esjl

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2316	2196	rundll32.exe	28
PID 2196 wrote to memory of 2316	2196	rundll32.exe	28
PID 2196 wrote to memory of 2316	2196	rundll32.exe	28
PID 2196 wrote to memory of 2316	2196	rundll32.exe	28
PID 2196 wrote to memory of 2316	2196	rundll32.exe	28
PID 2196 wrote to memory of 2316	2196	rundll32.exe	28
PID 2196 wrote to memory of 2316	2196	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\InputText.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\InputText.dll,#1
  2⤵
  PID:2316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2316-0-0x0000000000300000-0x0000000000340000-memory.dmp

Filesize
256KB

Download
memory/2316-1-0x00000000740EE000-0x00000000740EF000-memory.dmp

Filesize
4KB

Download
memory/2316-2-0x00000000002A0000-0x00000000002AE000-memory.dmp

Filesize
56KB

Download
memory/2316-3-0x0000000075040000-0x000000007504E000-memory.dmp

Filesize
56KB

Download