d3cf785008a467e4ddc26f49f711d6cc3cffc986ac83bdce58f3fec83046df36 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 03:00

Sharing

Report Analysis Logs

General

Target

$0/questbasic.dll
Size

868KB
MD5

3ce2d49509c3c0b6ebfdc47c743840f3
SHA1

8f04e2d9b41561821f58fd72a99c13a15a1a2aa4
SHA256

0143382a5b3f4148aa6fb89b97a50dc8ce199ee0c0bdcc1ba419a4c5b63d9dca
SHA512

fb831716ce1db52b8a0b9a38d2a176edf5751618443071e263da119ea502de7be0145dc3a65d01103b81cee1528a844c7ec6cde20de21d87644dde153bc38f57
SSDEEP

24576:04wisA7GA1zgECFzi/3qhaTxRo8hS8NYc1:BwisqXb2ycaFRo8RWc

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2732	2460	rundll32.exe	31
PID 2460 wrote to memory of 2732	2460	rundll32.exe	31
PID 2460 wrote to memory of 2732	2460	rundll32.exe	31
PID 2460 wrote to memory of 2732	2460	rundll32.exe	31
PID 2460 wrote to memory of 2732	2460	rundll32.exe	31
PID 2460 wrote to memory of 2732	2460	rundll32.exe	31
PID 2460 wrote to memory of 2732	2460	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$0\questbasic.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$0\questbasic.dll,#1
  2⤵
  PID:2732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads