ff8c11f132ed73ea6cbdf3dae4f8d02886392d66c1adfef3ad52f5a1f5022cb5 | Triage

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
19/06/2024, 15:18

Sharing

Report Analysis Logs

General

Target

Data/gdal201.dll
Size

11.7MB
MD5

9f07deda75fdb3b7fed978666f6139e7
SHA1

b4ab203e01d0418a80afdebedd88df158180fc29
SHA256

535b4760bb8e64b76e11ca29d9cb782582b1f00ddaa2d4722afcb4b6a700e18b
SHA512

b8b4c10a92513f83341067f0968ecf88073a8aecf06d3490d078b1923d8366a0738e20e0234302388cb0ec0367444cb7d0676b71fa0c54ecca9d215af52cabff
SSDEEP

196608:mhdZyIm2s5rssqaX+YrXIU7oynpOHhV3CvPug1GSWC:mhdsImssqaX+IXIOoyn0BV3CvPuoGSWC

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2308	1936	rundll32.exe	28
PID 1936 wrote to memory of 2308	1936	rundll32.exe	28
PID 1936 wrote to memory of 2308	1936	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\gdal201.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1936 -s 96
  2⤵
  PID:2308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads