8d87897242b12a5327ce2f4d6b5087a9a7c6071722c34e849b95730d6b7c1134 | Triage

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 20:34

Sharing

Report Analysis Logs

General

Target

system/encvag.dll
Size

147KB
MD5

dc48574dc8c7b4df5708a53af50afe8a
SHA1

fe1a8f55d9f4858de2a663c956c0050869d4c5d6
SHA256

c888278386ad6f171af5db05ab9d892e103fedf5fefa2c859634bae3206620e8
SHA512

8b8b9173ae17ad5f7eccc5c9b182327dcd0890eeddf3947b95c6747fb9c19ba8d416436b074f52ce059240b8babb00621fa5f69ca81d9c58dcfad4701372cec9
SSDEEP

3072:IWKgct047rv7SEDBdphwrDON//TpBnVjeJgTRuCp:IWKgOLvDSEDBV1p0WFp

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2056	3048	rundll32.exe	28
PID 3048 wrote to memory of 2056	3048	rundll32.exe	28
PID 3048 wrote to memory of 2056	3048	rundll32.exe	28
PID 3048 wrote to memory of 2056	3048	rundll32.exe	28
PID 3048 wrote to memory of 2056	3048	rundll32.exe	28
PID 3048 wrote to memory of 2056	3048	rundll32.exe	28
PID 3048 wrote to memory of 2056	3048	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\system\encvag.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\system\encvag.dll,#1
  2⤵
  PID:2056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads