c55732168517ea7a91d294844d2e32da201bb31e95ec484f68f29fa5efb5e08b | Triage

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
19-06-2024 17:04

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/inetc.dll
Size

61KB
MD5

8bde726084a37cacd13a7e03259f953f
SHA1

25400124fe8b399d659d5853f45e388a5a53b61a
SHA256

19a8e8aaa8a8d6c6e49ffd054b1c62f562eda5909aa6e7863c65c5f858f5fd18
SHA512

2f4932fade786312ba72c0f12d51bb1e561fd939597983dceccc0f0d7a53f18862f362473620c0788be039bb4977f0e23b541c61d67ab0ba9a043be963694b23
SSDEEP

768:IWAGVKaWi9rA8RhcTG3HvTIVQf3EczqWhP6v4d18a18Gvp23+zjB:IWRZ1zcybIm3EcNhUM8K8/0B

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 1460	1876	rundll32.exe	28
PID 1876 wrote to memory of 1460	1876	rundll32.exe	28
PID 1876 wrote to memory of 1460	1876	rundll32.exe	28
PID 1876 wrote to memory of 1460	1876	rundll32.exe	28
PID 1876 wrote to memory of 1460	1876	rundll32.exe	28
PID 1876 wrote to memory of 1460	1876	rundll32.exe	28
PID 1876 wrote to memory of 1460	1876	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetc.dll,#1
  2⤵
  PID:1460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads