c7164a6cf3cb8b7219ecdf48e07968515829790b7f6273d004c5c0ee168f67f9 | Triage

Resubmissions

24/06/2024, 22:28

240624-2dr32sycjk 7

24/06/2024, 22:21

240624-196qmsxhrk 7

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/R2RKORGKG.dll
Size

263KB
MD5

6321ff7e66a454c311d4d555b17f8567
SHA1

879fe8e563b4b7f471702c2ffc612851d8804145
SHA256

3a695de76d98f3ccc0b99475eaeff587c5d44dc8836de43a5fa73b1bf65a1ca2
SHA512

5a1c9a7e5786b62593afbeb27c628055fdd1d5930a126feb4886bbbc2a5e5d8e5031842fb14e0a0584a4885d286b8ff18c30e2d0c9e7f5988bafaf13410f1654
SSDEEP

6144:R3HbCkzvTPDVJzfZFTa8hfVwJ2CTLTBExfVNH:lHOg7P5JzxJ84yLT2JVNH

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2192	2176	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2176	2360	rundll32.exe	28
PID 2360 wrote to memory of 2176	2360	rundll32.exe	28
PID 2360 wrote to memory of 2176	2360	rundll32.exe	28
PID 2360 wrote to memory of 2176	2360	rundll32.exe	28
PID 2360 wrote to memory of 2176	2360	rundll32.exe	28
PID 2360 wrote to memory of 2176	2360	rundll32.exe	28
PID 2360 wrote to memory of 2176	2360	rundll32.exe	28
PID 2176 wrote to memory of 2192	2176	rundll32.exe	29
PID 2176 wrote to memory of 2192	2176	rundll32.exe	29
PID 2176 wrote to memory of 2192	2176	rundll32.exe	29
PID 2176 wrote to memory of 2192	2176	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\R2RKORGKG.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\R2RKORGKG.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 236
    3⤵
    - Program crash
    PID:2192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads