c4827529e2def5e26d6bfe6868476112aa760da579fa626b7e71cd14d6f317a1 | Triage

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 02:15

Sharing

Report Analysis Logs

General

Target

$TEMP/9GVDvgQt.dll
Size

113KB
MD5

aeedbcdadb4b116a3f22bc896b968cfe
SHA1

f04924da22aca8b3265d73c7f2e3265700c4b3ec
SHA256

b813a88126502e986ac6b469e803636c2e3b1db9374ecbb4a08c902b62995d05
SHA512

99aab12a274616cf6fa998e7d170c758aa458c7f9a3b8f050c9ecb18c637d6650a0c7a5aa1b946ad770284b3f17c38089364e1c73855134223dd51243446c50e
SSDEEP

3072:Q/9zE0G5HzLTDE5RV7xMBkwIDla1GqUvI3VX:Qq0GBLTiIKM2S

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2080	2232	rundll32.exe	30
PID 2232 wrote to memory of 2080	2232	rundll32.exe	30
PID 2232 wrote to memory of 2080	2232	rundll32.exe	30
PID 2232 wrote to memory of 2080	2232	rundll32.exe	30
PID 2232 wrote to memory of 2080	2232	rundll32.exe	30
PID 2232 wrote to memory of 2080	2232	rundll32.exe	30
PID 2232 wrote to memory of 2080	2232	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\9GVDvgQt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\9GVDvgQt.dll,#1
  2⤵
  PID:2080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads