2afb5303e191dde688c5626c3ee545e32e52f09da3b35b20f5e0d29a418432f5 | Triage

Analysis

max time kernel
1565s
max time network
1571s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 01:00

Sharing

Report Analysis Logs

General

Target

x86/plugins/SbieSupport.dll
Size

81KB
MD5

4daa3b45699017dce248b0e6f634885f
SHA1

c155ec9e2b1ab9b6178074ac3f7900bedff89cae
SHA256

d28a6bd0cbbe33c05586edbfa7266c85355e5762afd89a3633a23136723b625e
SHA512

a0e05a0aac333a7f62961e77f6ea1587bb16a986cf7cbd24f0f39942bf4403b9438f98e553c72643ead742590d0f300b605027cc9bc92a47a523167e2f2765e2
SSDEEP

1536:c1CLBSfuO2cTwGQXmj51Dds5Ecj3ksWhcdgZCnQnmxukfK1:c1CVg51Dpcjlg8nQnmxuky1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2000	2136	rundll32.exe	28
PID 2136 wrote to memory of 2000	2136	rundll32.exe	28
PID 2136 wrote to memory of 2000	2136	rundll32.exe	28
PID 2136 wrote to memory of 2000	2136	rundll32.exe	28
PID 2136 wrote to memory of 2000	2136	rundll32.exe	28
PID 2136 wrote to memory of 2000	2136	rundll32.exe	28
PID 2136 wrote to memory of 2000	2136	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\plugins\SbieSupport.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\plugins\SbieSupport.dll,#1
  2⤵
  PID:2000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads