daffaa21f751d95ca7461a21f4b49718a66fd7a2391dd0d96643ace0e9afcb43 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 10:53

Sharing

Report Analysis Logs

General

Target

dwzhq/zjhs/iext.dll
Size

212KB
MD5

1fc1f34f9d7adcc8a172d6de36b8b76a
SHA1

e4947a53a68745038e52ed4d318eeb928cf7702b
SHA256

880a0801b8d47effd0fe23fa67d093333107a2f9b65cf1e52f9aa9022712bd33
SHA512

9d1b5fff6dfc7cfc35615f154504c0fdde4ae0d62785c2d3fbf4a596c4ac748361e20ee4e939f74a52297e9d76d46d08f630c8a453d9a7e47a8e8059bb035c94
SSDEEP

3072:0Gttg9XUj+0CD39XwrXgEIpTIqniFgo6lNGd4lxf6dyj:Q0wFw0EInhGUV6d0

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2228	1952	rundll32.exe	28
PID 1952 wrote to memory of 2228	1952	rundll32.exe	28
PID 1952 wrote to memory of 2228	1952	rundll32.exe	28
PID 1952 wrote to memory of 2228	1952	rundll32.exe	28
PID 1952 wrote to memory of 2228	1952	rundll32.exe	28
PID 1952 wrote to memory of 2228	1952	rundll32.exe	28
PID 1952 wrote to memory of 2228	1952	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dwzhq\zjhs\iext.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dwzhq\zjhs\iext.dll,#1
  2⤵
  PID:2228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads