ba090f00dec7afbd561670d2a345193fe2d8c10688aa3b5c73972918d1a55a4a | Triage

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
26-06-2024 05:25

Sharing

Report Analysis Logs

General

Target

$TEMP/wifi.dll
Size

42KB
MD5

a25a29ea47be9246e5d6d13ca3f2d032
SHA1

33c6ee8b670bdb10f369540faf57715b4a5078bb
SHA256

d468f39a8633450a415c468123ff7b1debd8c948899c49d8eb9fd1d81b778805
SHA512

f1fcde0e4059abf063662bc676a5f014041984954775b113813d8fad14f1ed16526d380f7be31392c4a98a8c45154c57a9946f661d0d2ae17dc45875194aa3a1
SSDEEP

768:3p5kWv5gRwZwU+TXNtfklxC5GUz7vT6IwWhZYVRxigyOO+:Z6TNtfWQ5G6NwWhZYVRxV

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1704 wrote to memory of 1320	1704	rundll32.exe	rundll32.exe
PID 1704 wrote to memory of 1320	1704	rundll32.exe	rundll32.exe
PID 1704 wrote to memory of 1320	1704	rundll32.exe	rundll32.exe
PID 1704 wrote to memory of 1320	1704	rundll32.exe	rundll32.exe
PID 1704 wrote to memory of 1320	1704	rundll32.exe	rundll32.exe
PID 1704 wrote to memory of 1320	1704	rundll32.exe	rundll32.exe
PID 1704 wrote to memory of 1320	1704	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\wifi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1704

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\wifi.dll,#1
2⤵
PID:1320

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...