755d11ba3943ba14071f4bdb5b10d3a1db96fdbf637a2851317304aa2523a4b4 | Triage

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 09:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Plugins/reaper_cd.dll
Size

38KB
MD5

75dde8239ef611edf6c713c068291608
SHA1

83c82b7229047b21065964f9d9d46160b37bfede
SHA256

265869eaca9f3c3cea99cc6c5c705a21d874a2413f52dd6602f9d5c17c03caab
SHA512

cb550de0c7c040730963619ce7ebf1ff867598e0b8f9dd89aba735175a2ecb32030315b6e638419c03318dd0d522a898e6e528f259b063a9f4e2515fae87dc75
SSDEEP

768:lkQcGaLvZHlJF+ACpk5rWjE8N5XO+v249lRza:l7axHFROu8/nFRz

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2544	2392	rundll32.exe	28
PID 2392 wrote to memory of 2544	2392	rundll32.exe	28
PID 2392 wrote to memory of 2544	2392	rundll32.exe	28
PID 2392 wrote to memory of 2544	2392	rundll32.exe	28
PID 2392 wrote to memory of 2544	2392	rundll32.exe	28
PID 2392 wrote to memory of 2544	2392	rundll32.exe	28
PID 2392 wrote to memory of 2544	2392	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\reaper_cd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\reaper_cd.dll,#1
  2⤵
  PID:2544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads