e223f60ac7d4de97d15b02c451531144e95b2a2caabf73ef11a05863116eac54 | Triage

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 04:14

Sharing

Report Analysis Logs

General

Target

$0/zwankysearch.dll
Size

564KB
MD5

50c053dde12ebd2beaef57da46b978b3
SHA1

2b50d1e332b100fb34c69ca2fc71af73a5dca37a
SHA256

d472a71268d322f9bbb476d9436f8e3f1de7544a1931e79ab2e74ca466d69fc8
SHA512

6acf284544a0eafc5a7d28362ff243784668550a1a4a3160720dd8d932a7893a6802fc72c07066383e20357c9884a6274f3bbce13b8087b514837ec44ffaaf2c
SSDEEP

12288:yXOxCW8+P2a2MMcd/x8e6nEVsMGtSuPnWOjiJZQ0PC:9xo+Pj2i/x8n6sMGwy9jiJHPC

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 1708	1932	rundll32.exe	28
PID 1932 wrote to memory of 1708	1932	rundll32.exe	28
PID 1932 wrote to memory of 1708	1932	rundll32.exe	28
PID 1932 wrote to memory of 1708	1932	rundll32.exe	28
PID 1932 wrote to memory of 1708	1932	rundll32.exe	28
PID 1932 wrote to memory of 1708	1932	rundll32.exe	28
PID 1932 wrote to memory of 1708	1932	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$0\zwankysearch.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$0\zwankysearch.dll,#1
  2⤵
  PID:1708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1708-0-0x00000000004F0000-0x0000000000572000-memory.dmp

Filesize
520KB

Download