2afb5303e191dde688c5626c3ee545e32e52f09da3b35b20f5e0d29a418432f5 | Triage

Analysis

max time kernel
1558s
max time network
1563s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 01:00

Sharing

Report Analysis Logs

General

Target

x86/plugins/ExtendedTools.dll
Size

171KB
MD5

013dbb7c2ad8ba8b253a79c38caa5fe2
SHA1

5843281bcf9ee9bbc07179ef5032b5b7c8dcc555
SHA256

b029eb3a7444fa333daf8410dad0f770e2e9ff57a3ba6bbdd8b5d2696f43646d
SHA512

34d79a48a7d1af61f79c5f5dfa3fb5ce4f80c96ca078b343f03b57dfa8ab180a1ace9ff7501253c4a30cd2f1122f9154e2bfad8ea8b0aa31707e3ba31859e126
SSDEEP

3072:TACydNlIeMYoFoafAYDhjstr3cU/exUyND5VpCb2:TATeiNc3KU5Cb2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 496	2812	rundll32.exe	28
PID 2812 wrote to memory of 496	2812	rundll32.exe	28
PID 2812 wrote to memory of 496	2812	rundll32.exe	28
PID 2812 wrote to memory of 496	2812	rundll32.exe	28
PID 2812 wrote to memory of 496	2812	rundll32.exe	28
PID 2812 wrote to memory of 496	2812	rundll32.exe	28
PID 2812 wrote to memory of 496	2812	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\plugins\ExtendedTools.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\plugins\ExtendedTools.dll,#1
  2⤵
  PID:496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads