ff4bacc28cf6eb2e123bb9ef5fc818ace9f83c3c398d2d9ab78b80c224cdb7ba | Triage

Analysis

max time kernel
3s
max time network
20s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 23:47

Sharing

Report Analysis Logs

General

Target

GMS-WinDev.dll
Size

85KB
MD5

fb1e3cb9d7fff99956c96baf742dbf6f
SHA1

65777480cd33d413bcee7bef89a2be8827bc0b29
SHA256

fc86c4f3e9bcb57928cab5ebc43c99093b78c97246d400447aa1b4a5bd524266
SHA512

512b60c28de4e0d591d72086009396439d1f7635c3c2aab04d0a30398b0f1db8dc16c4baf1ccca32233783482aff3bd39bd8e6888c49ec715bda3c1895a9e136
SSDEEP

1536:VPU8NF9DVMY3UWuFw1LLzhuw0+XA3tJqUsWiJcdAGCKyAP8NqM:Xqy3uw1LLtnKNADrAP8NH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 1756	2456	rundll32.exe	29
PID 2456 wrote to memory of 1756	2456	rundll32.exe	29
PID 2456 wrote to memory of 1756	2456	rundll32.exe	29
PID 2456 wrote to memory of 1756	2456	rundll32.exe	29
PID 2456 wrote to memory of 1756	2456	rundll32.exe	29
PID 2456 wrote to memory of 1756	2456	rundll32.exe	29
PID 2456 wrote to memory of 1756	2456	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GMS-WinDev.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\GMS-WinDev.dll,#1
  2⤵
  PID:1756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads