Analysis

  • max time kernel
    121s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    18-06-2024 14:48

General

  • Target

    #!~#0PEn_9797_P@$SW0rd~!^!!$/madexcept_.dll

  • Size

    436KB

  • MD5

    98e59596edd9b888d906c5409e515803

  • SHA1

    b79d73967a2df21d00740bc77ccebda061b44ab6

  • SHA256

    a6ca13af74a64e4ab5ebb2d12b757cecf1a683cb9cd0ae7906db1b4b2c8a90c0

  • SHA512

    ba617227849d2eb3285395e2d1babfe01902be143144be895011f0389f1860d0d7f08c6bbc4d461384eba270f866cce3351f52af1dc9ef9719c677619de79e42

  • SSDEEP

    6144:1lAz49EKhEV30F8sl88nTjQ4Q50gEcW/jd+o72niVUNMa4Yn2g:1lG4ut30F8slzYlQcW/jd++2nJ6u2g

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0PEn_9797_P@$SW0rd~!^!!$\madexcept_.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1600
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\#!~#0PEn_9797_P@$SW0rd~!^!!$\madexcept_.dll,#1
      2⤵
        PID:316

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads