8454e4a8b248a7f384035e9b45d9badb5f121e9d047d9dcce22bb4ee7e73e85b | Triage

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 11:30

Sharing

Report Analysis Logs

General

Target

CoreFlash.dll
Size

101KB
MD5

0b363702afc83c2abcd348d9890afbd4
SHA1

c45a25ce3cc495adc4027116477305814a908640
SHA256

686a69c32c231b52025eb5b1d9cd205d16805e38606f8f3dccbf8ddbf86f8708
SHA512

06223b5432949a43f5adff91202def3583adcf938f5d2d8f467798cd9db7c5a384b70be61e52ca4a798ef58ec7923e434d8c851392a60b46420428062140a77f
SSDEEP

3072:O3rYYLxNDVIICF3SXgUmnezbxveNGv+ktdUINqlxXO1Lx16:Ofj81IVvklxXO1L

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2864	2820	rundll32.exe	30
PID 2820 wrote to memory of 2864	2820	rundll32.exe	30
PID 2820 wrote to memory of 2864	2820	rundll32.exe	30
PID 2820 wrote to memory of 2864	2820	rundll32.exe	30
PID 2820 wrote to memory of 2864	2820	rundll32.exe	30
PID 2820 wrote to memory of 2864	2820	rundll32.exe	30
PID 2820 wrote to memory of 2864	2820	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CoreFlash.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CoreFlash.dll,#1
  2⤵
  PID:2864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads