2afb5303e191dde688c5626c3ee545e32e52f09da3b35b20f5e0d29a418432f5 | Triage

Analysis

max time kernel
1561s
max time network
1562s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 01:00

Sharing

Report Analysis Logs

General

Target

x86/plugins/ExtendedNotifications.dll
Size

120KB
MD5

56cc0204d69be9fe0987f6570783a138
SHA1

f6024adbc00c3caef570331a82ce9535ddafd51d
SHA256

c1a74caa7da222a78715d4307f6247cb8aba4cb01434286e17d9cb18860aa612
SHA512

86ee5535ee14cd55940d4562edf0f744410ad46fdcb7256552755412242e3ece02564ad577d3d3a4de75c497a8ece67cc690f4b7b76abfd37b8129d750c2069d
SSDEEP

3072:lQSnPFFFd7h7ZpcotN5grnrzAjixjIZo/dgo:lxnPTFZ17AFxqo

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2116	2192	rundll32.exe	28
PID 2192 wrote to memory of 2116	2192	rundll32.exe	28
PID 2192 wrote to memory of 2116	2192	rundll32.exe	28
PID 2192 wrote to memory of 2116	2192	rundll32.exe	28
PID 2192 wrote to memory of 2116	2192	rundll32.exe	28
PID 2192 wrote to memory of 2116	2192	rundll32.exe	28
PID 2192 wrote to memory of 2116	2192	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\plugins\ExtendedNotifications.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\plugins\ExtendedNotifications.dll,#1
  2⤵
  PID:2116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads