bca0512297bc9f94edf7995885d2b3604c535c8c9e6f0ab8a452dbfa0bfbbf1c | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
03-07-2024 13:37

Sharing

Report Analysis Logs

General

Target

rasEventdlg.dll
Size

132KB
MD5

4b54c0c2c843992045344fea9558c5d4
SHA1

9c502b47faad39ded674c80b3b65d0be69f2d536
SHA256

142794326256a6df8ff72e405f3f0a781eb6765df8ecccb07a342d6af59ede34
SHA512

7360355d7a7fc240d236d71a362d49233b7e6ea9b05cb6e29d222bf8654bb29108dc025eda719dc964b1f219b85cf91eef00885ee18e1501672ae62a169f38ba
SSDEEP

3072:pkOeGOaGTY6ckbgXzrEpB7UGWQ916PGxdHFyaMfjQncdqA:hcqz2B7U1Q916Pqdka80cdqA

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 3068	2276	rundll32.exe	28
PID 2276 wrote to memory of 3068	2276	rundll32.exe	28
PID 2276 wrote to memory of 3068	2276	rundll32.exe	28
PID 2276 wrote to memory of 3068	2276	rundll32.exe	28
PID 2276 wrote to memory of 3068	2276	rundll32.exe	28
PID 2276 wrote to memory of 3068	2276	rundll32.exe	28
PID 2276 wrote to memory of 3068	2276	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\rasEventdlg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\rasEventdlg.dll,#1
  2⤵
  PID:3068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads