243f3743b7c0353104dffd185aa6d754407e7b31c3840e30fdc5ec66d7f1c11b | Triage

Analysis

max time kernel
122s
max time network
143s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 05:35

Sharing

Report Analysis Logs

General

Target

[3.9.11.19]/ConfSdk.dll
Size

1.4MB
MD5

d56b07e5c1a83171abdef48ee0191dac
SHA1

5754c87f587c0e165679857342cbf1c7dc288342
SHA256

46513d7887ae3facd4d3cff7cd12750e0c67f95b63af1a3b68034abb2c7abaa7
SHA512

1ea3111190b66bbc84c0eebad51a0660dc4a4118d9d65d8deede5379193a8151217b7edc8a16a6821fb0e96c0fc0ca51c699336d2afe0c3915d7bdea50f7ae7b
SSDEEP

24576:xs4pBaJdHaijaF2U2ap8gaew4/ixgn87XncxlxHLRzYGs3qrQ/jx:CGZmnu87Xncx7LOGsLt

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2704	2700	rundll32.exe	30
PID 2700 wrote to memory of 2704	2700	rundll32.exe	30
PID 2700 wrote to memory of 2704	2700	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\[3.9.11.19]\ConfSdk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2700 -s 172
  2⤵
  PID:2704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads