6fd01e7c046a0dbee635b69f5457a6d62405fd16faa30b708b8ecf41847867fd | Triage

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10-07-2024 02:06

Sharing

Report Analysis Logs

General

Target

tools/cygwinb19.dll
Size

653KB
MD5

d388339d43a0e83c6effd1de09a91c30
SHA1

3988bddacf90569886a2505ec6eef8faf1c61df6
SHA256

61f3bd4efe4de44664eea151202542f058e2e247e28dcea4e5ac810a73d251f4
SHA512

83b61b44c20cabea1b7841d47a156e406f438023bbab4d35a9a90a1bff377da688e18841a39087c06182a2f0d428dd6b82783536ac99936d98f665fc1af3966c
SSDEEP

12288:ZBcweFLCwKDMpvVEiDTf5SUd9aw8s+r53fMyPMh39coCtE:D7twruiDTfT0w8s+93bPwcfy

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 1956	2472	rundll32.exe	28
PID 2472 wrote to memory of 1956	2472	rundll32.exe	28
PID 2472 wrote to memory of 1956	2472	rundll32.exe	28
PID 2472 wrote to memory of 1956	2472	rundll32.exe	28
PID 2472 wrote to memory of 1956	2472	rundll32.exe	28
PID 2472 wrote to memory of 1956	2472	rundll32.exe	28
PID 2472 wrote to memory of 1956	2472	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\tools\cygwinb19.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\tools\cygwinb19.dll,#1
  2⤵
  PID:1956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads