15855eb71ab14975030f8556e6f375d0dc1119d3c577f960d9cf74b8994a0ea1 | Triage

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 18:28

Sharing

Report Analysis Logs

General

Target

KwHttp.dll
Size

32KB
MD5

a643deebd7b6b8fbd489c16a8754f748
SHA1

d5fd8458730383da826d7f045ddd6d4b0b6d5285
SHA256

156e213bbb69da400098cdd535b9735f8c7484a3c204d961bf0a04e98603ce2a
SHA512

a13a5c7c78e8eab605b96217718ed550bc81c31874c9e7214c3bd70db55282f73dac3359abcb105f5f19db1d8f2269025d7df1f8c31bc63eb91d6d947d500ab7
SSDEEP

768:JroyX6reiBZej10mgyjwK0tjOtK9rt1Uk:JL6rlZeJbgyj0tjOtKe

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\mylkx.dat	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\Log	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2412	2408	rundll32.exe	28
PID 2408 wrote to memory of 2412	2408	rundll32.exe	28
PID 2408 wrote to memory of 2412	2408	rundll32.exe	28
PID 2408 wrote to memory of 2412	2408	rundll32.exe	28
PID 2408 wrote to memory of 2412	2408	rundll32.exe	28
PID 2408 wrote to memory of 2412	2408	rundll32.exe	28
PID 2408 wrote to memory of 2412	2408	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\KwHttp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\KwHttp.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:2412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2412-2-0x00000000001E0000-0x00000000001F0000-memory.dmp

Filesize
64KB

Download
memory/2412-0-0x0000000000200000-0x0000000000238000-memory.dmp

Filesize
224KB

Download
memory/2412-3-0x0000000000350000-0x00000000003D8000-memory.dmp

Filesize
544KB

Download