a67841ce6c21b1e48913310654d1501e691052a92369dfcefa1f24690e834ed4 | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
19/06/2024, 19:39

Sharing

Report Analysis Logs

General

Target

PP2008/CMUpnp.dll
Size

80KB
MD5

8cb8322b8690b383fa74a4603e745e6d
SHA1

693640170675e5552dbeb873c456f23c9a5ef9c3
SHA256

98b8baccc7c5442e08bebefc1ae7d1b8c5fb3fa899b96addd687f049bf6432b0
SHA512

4c18dc34668bded85b70f8fa7993e90ac2f12e06811ca44ed5ed08d899051889b46c40a0db0d358c27a981c570453062a5fba3d01219956b206e295a92f7bd6d
SSDEEP

1536:Ol4F0ybIvCENPfyXJG98t66AwJ8krv7CsGYPl3:OG0ybOCysH6gN+1YPl3

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2052	2288	rundll32.exe	28
PID 2288 wrote to memory of 2052	2288	rundll32.exe	28
PID 2288 wrote to memory of 2052	2288	rundll32.exe	28
PID 2288 wrote to memory of 2052	2288	rundll32.exe	28
PID 2288 wrote to memory of 2052	2288	rundll32.exe	28
PID 2288 wrote to memory of 2052	2288	rundll32.exe	28
PID 2288 wrote to memory of 2052	2288	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PP2008\CMUpnp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PP2008\CMUpnp.dll,#1
  2⤵
  PID:2052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads