3fd157484c55d7b3871ed546865836985ec4995a38fae1b1719ceed6dfb5bb67 | Triage

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
19/06/2024, 21:20

Sharing

Report Analysis Logs

General

Target

Kernel/PPStream/pp2play.dll
Size

192KB
MD5

7791035a57a5c4d54b88fb22ef7204c7
SHA1

f55c9dca739eb9cdd9dfe42418b4cf9f351f8837
SHA256

110e592c241aba9ef388796fc40fa6c0dbb7d95a8bb5433f2086651b208c6b80
SHA512

f726c91fc4d4dd7046c2c3d07e873de5e05de523825a060fa376441c421e5f99562dafddc5861f0f75dc9b040463feed33eaeb17567a0d30d70f58030139b030
SSDEEP

3072:Of5d0X4tYM96H+QiGwTsz0Lt150XkllctdAMt4K:ORXt/9E5iDsG150ttdAg

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 1708	1940	rundll32.exe	28
PID 1940 wrote to memory of 1708	1940	rundll32.exe	28
PID 1940 wrote to memory of 1708	1940	rundll32.exe	28
PID 1940 wrote to memory of 1708	1940	rundll32.exe	28
PID 1940 wrote to memory of 1708	1940	rundll32.exe	28
PID 1940 wrote to memory of 1708	1940	rundll32.exe	28
PID 1940 wrote to memory of 1708	1940	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Kernel\PPStream\pp2play.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Kernel\PPStream\pp2play.dll,#1
  2⤵
  PID:1708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads