d88e7a747d4889013c3b2eea2a99d28f4a559d8801296906476d8475a1967fda | Triage

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 20:44

Sharing

Report Analysis Logs

General

Target

_gdi_.dll
Size

704KB
MD5

d84d3aa176f2c2da335dec901fa55cbc
SHA1

946ba1138b5c9f006698d611515cc96c2188834a
SHA256

acc6701c21b891a86dfbb025d350347c1f6f04411edc99b4b84145f8c6f04286
SHA512

7f1c626743c58ad93ad3f294d27e329aaae29d4e061a8a751fbb9fdc072c569ca9b8fae2521ec65ced32ec7a886d0e19230cc5086c39defc3b78aa47707888c4
SSDEEP

12288:XMVrEj7DI/kY4FZvzaUOrNupDzQl1WqMqh11iUQPJdXEaBRAQn:cVrEj7DekY4Ft+EJbqJh18PP1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 1888	2468	rundll32.exe	28
PID 2468 wrote to memory of 1888	2468	rundll32.exe	28
PID 2468 wrote to memory of 1888	2468	rundll32.exe	28
PID 2468 wrote to memory of 1888	2468	rundll32.exe	28
PID 2468 wrote to memory of 1888	2468	rundll32.exe	28
PID 2468 wrote to memory of 1888	2468	rundll32.exe	28
PID 2468 wrote to memory of 1888	2468	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\_gdi_.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\_gdi_.dll,#1
  2⤵
  PID:1888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1888-0-0x0000000000B20000-0x0000000000C50000-memory.dmp

Filesize
1.2MB

Download
memory/1888-2-0x0000000000170000-0x00000000001C6000-memory.dmp

Filesize
344KB

Download
memory/1888-4-0x0000000002140000-0x000000000244A000-memory.dmp

Filesize
3.0MB

Download