d7d47aa5796cad499374b284e865f715e7496efca16566add1c3a505730259de | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 06:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

kkdownload.dll
Size

303KB
MD5

b600f10be5b9aaefc5f8c9c1a66d3037
SHA1

8b907adcd9b644e00437b36ff15ce656a605b776
SHA256

f22696351d4787e31c96dcde40fddc30c20cbd5474fa4cf2da8091830a4f4bb6
SHA512

2127fcd25322699e6916c33be44bb62bd74578ff5a4f25e1f2fb124097bc61fd8d9293c8224a1fc55f86a21c4f56a0cd7cbf91f61449aa401432a52d8ebc4512
SSDEEP

6144:OIR37oPOE9acXJRg2vtprPbmO7ACJg7Od8PsqikG07:OIJWZaotpGqJJg7Od8PsSG07

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 1696	1544	rundll32.exe	28
PID 1544 wrote to memory of 1696	1544	rundll32.exe	28
PID 1544 wrote to memory of 1696	1544	rundll32.exe	28
PID 1544 wrote to memory of 1696	1544	rundll32.exe	28
PID 1544 wrote to memory of 1696	1544	rundll32.exe	28
PID 1544 wrote to memory of 1696	1544	rundll32.exe	28
PID 1544 wrote to memory of 1696	1544	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\kkdownload.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\kkdownload.dll,#1
  2⤵
  PID:1696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads