32c6159d8ab85dc2bbfab4ad7c5ebd81338d968b3440a3909466cdc8a2a9b30d | Triage

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 04:28

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/RCWidgetPlugin.dll
Size

3.4MB
MD5

ff9254dc1c26b40a01e4933dedc77f38
SHA1

66f54c9977b60d286acdf52c196f1af61e8c9fa2
SHA256

aba35f3d0487ffae1fe5dd350b9872addd369b9013e2cfea133256936c1be821
SHA512

4484144dba85c45b6cb5880a21f0692cf056463207cfe34462c98100bd5469a39dc9154e1a75cedda5ec55a3979e155962e4660624b3c9e07b6149bf923d76b5
SSDEEP

98304:5tS9Zl9NMdJD8wbPQxJ8pukhw0PUPfJvKL:54NSdJDcvUwdu

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 1656	2284	rundll32.exe	28
PID 2284 wrote to memory of 1656	2284	rundll32.exe	28
PID 2284 wrote to memory of 1656	2284	rundll32.exe	28
PID 2284 wrote to memory of 1656	2284	rundll32.exe	28
PID 2284 wrote to memory of 1656	2284	rundll32.exe	28
PID 2284 wrote to memory of 1656	2284	rundll32.exe	28
PID 2284 wrote to memory of 1656	2284	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\RCWidgetPlugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\RCWidgetPlugin.dll,#1
  2⤵
  PID:1656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads