2afb5303e191dde688c5626c3ee545e32e52f09da3b35b20f5e0d29a418432f5 | Triage

Analysis

max time kernel
1563s
max time network
1565s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 01:00

Sharing

Report Analysis Logs

General

Target

x86/plugins/ExtendedServices.dll
Size

116KB
MD5

0c1a9c2a6190f1baab115316da215f89
SHA1

71326114c50ec7fd3afdf9ab43cc631fb32a40d0
SHA256

647611756cac85d8fcc8cd78efdc5712c68e4fe7bbcc8a64081900c68bcc0feb
SHA512

b7abf69665970cbfd7d07607a1b92048c499c15c1d17c10135c4c7e596063eabd17809e7073cc2fb4861b4275a3e88e767c43ab53785a20cdd18d79883b6d042
SSDEEP

3072:uSRJylyd/ga0uHdtBTIzBHdcAOcn3+0ec7bOH/:BRJfJMmaORH/

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 1760	1740	rundll32.exe	28
PID 1740 wrote to memory of 1760	1740	rundll32.exe	28
PID 1740 wrote to memory of 1760	1740	rundll32.exe	28
PID 1740 wrote to memory of 1760	1740	rundll32.exe	28
PID 1740 wrote to memory of 1760	1740	rundll32.exe	28
PID 1740 wrote to memory of 1760	1740	rundll32.exe	28
PID 1740 wrote to memory of 1760	1740	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\plugins\ExtendedServices.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\plugins\ExtendedServices.dll,#1
  2⤵
  PID:1760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads