b80f22e99442d50f5f294a9871711bb5c5adfa4346526df36cca2c98d2f860cb | Triage

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08-07-2024 06:29

Sharing

Report Analysis Logs

General

Target

plugins/LANRedTRainer.dll
Size

425KB
MD5

8cab83db38b95c9cee6c8d8aa0cbfbf1
SHA1

0fbf3f35c275be940da1341016e27b314c394b6f
SHA256

71a9cc60e1420a7a5866d96c4bde2e71db742b4c277a50c101d6fadfad79f772
SHA512

d75c79a992c0773c0fcc60bfd038d8d58f37a5b3439dc83d61035ba0da069eb32c8d6853ecf1741e06635f791751d2ed1f404bb221f6406e017a84ea2c990401
SSDEEP

6144:18jwdVt59T8w6VAWGx9qYiOmI5t0PS8b10KESumocP3aygZ:fdVt550GHqYDt0qK10Khu3cP3

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2696	2276	rundll32.exe	30
PID 2276 wrote to memory of 2696	2276	rundll32.exe	30
PID 2276 wrote to memory of 2696	2276	rundll32.exe	30
PID 2276 wrote to memory of 2696	2276	rundll32.exe	30
PID 2276 wrote to memory of 2696	2276	rundll32.exe	30
PID 2276 wrote to memory of 2696	2276	rundll32.exe	30
PID 2276 wrote to memory of 2696	2276	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\plugins\LANRedTRainer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\plugins\LANRedTRainer.dll,#1
  2⤵
  PID:2696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads