06a448f5d8d34f922d25a4bf5bf1fd0eea0624b799c68677becd75135abb0d52 | Triage

Resubmissions

13/07/2024, 04:14

240713-etre5avgjn 8

Analysis

max time kernel
1561s
max time network
1566s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 04:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

[ProductDir]/ToastNotify.dll
Size

160KB
MD5

4595ab7b604955dd0e155249e82bc90a
SHA1

4bab15511e509a0f5ba45ec69eda1fca6f37e0c5
SHA256

64f4eff8b60e628ff53a5c3379c990ab1355575812e5cde9e0b9b4a62ddf7a5c
SHA512

a81cbaca3800406fdadf3fb310c61f3456977a8d0316efb73acc4eaed1a91d923dde3bdb849ad91cc47346fd3d116e1a0d68416a1ea9b2d2c3954b98f2a0259b
SSDEEP

3072:DRGXv2U1tSF8e28Mj9pPjlboRqLiETwI4Rsf:cO626rjTKVPa

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 2336	2752	rundll32.exe	30
PID 2752 wrote to memory of 2336	2752	rundll32.exe	30
PID 2752 wrote to memory of 2336	2752	rundll32.exe	30
PID 2752 wrote to memory of 2336	2752	rundll32.exe	30
PID 2752 wrote to memory of 2336	2752	rundll32.exe	30
PID 2752 wrote to memory of 2336	2752	rundll32.exe	30
PID 2752 wrote to memory of 2336	2752	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\[ProductDir]\ToastNotify.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\[ProductDir]\ToastNotify.dll,#1
  2⤵
  PID:2336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads