3e25ad175c98d9c28c5a451f708acdac2337d97ea5615007e0dc5d3b34064ef1 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 17:39

Sharing

Report Analysis Logs

General

Target

$R0/plptjm2.dll
Size

242KB
MD5

800ee9432f8bce041078f03ca5b1027d
SHA1

16893df3c387b762f6aedc2c375f2589c0bfd76d
SHA256

9267d6c3a316082193c314fac153cf2531a9f1f496aa4cab771f2e3c96f9712c
SHA512

2bcc0d243abecd68d172d446088b3f6a0e1c5cfe70bfc2ec188cb9dc3f2c3118ac26317c49e3b33342c890a04f1773bb052d34729d2fe9aa5a2e0df427ff667b
SSDEEP

6144:c6y3um791tdvuBkvVhliM7zC8vlaHY6MApYn:c73uQ91LvVhJXx9a46M7

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 2212	1912	rundll32.exe	28
PID 1912 wrote to memory of 2212	1912	rundll32.exe	28
PID 1912 wrote to memory of 2212	1912	rundll32.exe	28
PID 1912 wrote to memory of 2212	1912	rundll32.exe	28
PID 1912 wrote to memory of 2212	1912	rundll32.exe	28
PID 1912 wrote to memory of 2212	1912	rundll32.exe	28
PID 1912 wrote to memory of 2212	1912	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$R0\plptjm2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$R0\plptjm2.dll,#1
  2⤵
  PID:2212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2212-0-0x0000000010000000-0x00000000100F4000-memory.dmp

Filesize
976KB

Download