4cb12d39a1d957e681fa7d5b4c673d57ffe94af3bc0203bd8fc5b24c034bd971 | Triage

Analysis

max time kernel
15s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 14:17

Sharing

Report Analysis Logs

General

Target

icmp.dll
Size

3KB
MD5

67e3e7be9be25202604eccbde795d93d
SHA1

69d030277fbe63e33e399678416a80a29d68e69f
SHA256

0591d0a536e3eacb642d64a52df122839c4dade741da8c474a1d0d7d457c0a05
SHA512

950c84e7d8128310dbc29034ecd420183d2489c6d382357a922b50913e7dcfd05898469336097a31aedea83db5073a915f1c3f8d6d411333c79a34e520b8769e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2968	2488	rundll32.exe	29
PID 2488 wrote to memory of 2968	2488	rundll32.exe	29
PID 2488 wrote to memory of 2968	2488	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\icmp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2488 -s 84
  2⤵
  PID:2968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads