45446f6e7551da01e6b6eca54c82f5584b34fa5b71517e2f3977939dfb0e876b | Triage

Analysis

max time kernel
1558s
max time network
1568s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12-07-2024 01:29

Sharing

Report Analysis Logs

General

Target

System.Console.dll
Size

154KB
MD5

9b18a6627b27d2aadad0d7b2dc42414d
SHA1

eb96a2e1ffa11dd3167fcabe69c4768e514dde95
SHA256

79815e1044ac3f10597a9014d07b2c5aa5a2b7e7da0299843e3ef1bae5a5b7f4
SHA512

9cb0bcbd3b63c470101a2e91b85c918ca25fa06ea07242f33141a42d9463882c86277820ec6658bfedb55098304f5f9c0a967498619c4df20923973656c7c5b6
SSDEEP

3072:AoO/mX67cJR50QAuetvH7ARZvcKZF4fJXtq3:1X67cJR505b2ZvcKeh+

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2688 wrote to memory of 2772	2688	rundll32.exe	rundll32.exe
PID 2688 wrote to memory of 2772	2688	rundll32.exe	rundll32.exe
PID 2688 wrote to memory of 2772	2688	rundll32.exe	rundll32.exe
PID 2688 wrote to memory of 2772	2688	rundll32.exe	rundll32.exe
PID 2688 wrote to memory of 2772	2688	rundll32.exe	rundll32.exe
PID 2688 wrote to memory of 2772	2688	rundll32.exe	rundll32.exe
PID 2688 wrote to memory of 2772	2688	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.Console.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.Console.dll,#1
  2⤵
  PID:2772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads