0534bd590fba16ba535feaa26babf7dd209ab721ade2c11ffbd26dd44712015a | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 11:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/mIRC.dll
Size

30KB
MD5

8423ec692d326f92dfa7db57f977d315
SHA1

65fd701692fab6dfe24ba0fa2b29e474b6f5da56
SHA256

0d1218f43e2b5b0d4e052918b5193e7e050bb9f0a9bfc39f7395276b8399b50e
SHA512

fbb0f057dc192362584efbbb5e0c9c6fa56584580b3190aba83017905a50b9b3f54aa535281eac34f4a07538a4ddee822d974cb512b4afe28e15b504376102fd
SSDEEP

768:mbMSwdtV3+m2eTu9WumcyQYbHYsvcdQ0:aMVtTu9XBPYhvcb

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 3064	2416	rundll32.exe	30
PID 2416 wrote to memory of 3064	2416	rundll32.exe	30
PID 2416 wrote to memory of 3064	2416	rundll32.exe	30
PID 2416 wrote to memory of 3064	2416	rundll32.exe	30
PID 2416 wrote to memory of 3064	2416	rundll32.exe	30
PID 2416 wrote to memory of 3064	2416	rundll32.exe	30
PID 2416 wrote to memory of 3064	2416	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\mIRC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\mIRC.dll,#1
  2⤵
  PID:3064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads