3aeea541c4fcdbf46b3e904522682e638b9ca7a981379864a72cf2274654419e | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 12:05

Sharing

Report Analysis Logs

General

Target

tray_manager_plugin.dll
Size

113KB
MD5

65dcbb76cbb2bbb1684186f1520e888d
SHA1

25d656c1cb3c814776779bc53e0e2b937d8441f4
SHA256

9c7e0de576932c8b2149849c96f3493bcae215f6db5996dbaf5ae1788697e8f0
SHA512

e351547e551943db0267828e283797c81b593ec303cee4d4447226e86927acac93b87226e79e1a913a1ec397b4183b7ee81a2af8764f71d7fa73c41bb102d9ca
SSDEEP

3072:IVV+oRKikJVXx0esFNKKr9VNLe1Zl1QaI:MVxRkJVh0esLKKr9VNLe1Zl1Q

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 2368	2880	rundll32.exe	28
PID 2880 wrote to memory of 2368	2880	rundll32.exe	28
PID 2880 wrote to memory of 2368	2880	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\tray_manager_plugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2880 -s 224
  2⤵
  PID:2368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads