2afb5303e191dde688c5626c3ee545e32e52f09da3b35b20f5e0d29a418432f5 | Triage

Analysis

max time kernel
1557s
max time network
1558s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 01:00

Sharing

Report Analysis Logs

General

Target

x86/plugins/UserNotes.dll
Size

96KB
MD5

7de6aa4f0d79e4b243a66b4db6f17fe9
SHA1

0137fd9f2e0115e88003b80942b137ad83b52f5b
SHA256

a94d02d9645a4f4fe0388bb40775862aa3f90d22a93fdb14870389ab891b486d
SHA512

1fa4216fcf84663c185a2b244055d93b25a3242d79699a7973dc0ea50b80c4cd21df52cc6601868c9d68591d667130f4b2408093ea93641a14a352e8788d1bee
SSDEEP

3072:mEuN4hL6EK8WvWCR3RPPp9KjqzUJEAElDBUh3:9L88Wz3zYKKh3

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1520	2036	rundll32.exe	28
PID 2036 wrote to memory of 1520	2036	rundll32.exe	28
PID 2036 wrote to memory of 1520	2036	rundll32.exe	28
PID 2036 wrote to memory of 1520	2036	rundll32.exe	28
PID 2036 wrote to memory of 1520	2036	rundll32.exe	28
PID 2036 wrote to memory of 1520	2036	rundll32.exe	28
PID 2036 wrote to memory of 1520	2036	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\plugins\UserNotes.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\plugins\UserNotes.dll,#1
  2⤵
  PID:1520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads