941090f3a99a3ff0f04a50b9cfcf3c17f26193653c2de830dd6d55831e69eb4f | Triage

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 07:32

Sharing

Report Analysis Logs

General

Target

$0/basicscan.dll
Size

657KB
MD5

2d2898e74625c448a724b85879b631fa
SHA1

a3cad1f820ebb74225108120d81fe50ab6c49f4f
SHA256

44fcad650b1ffb9b7d358512fa082fd509839523568ee6f0d9d6a17f2bc55918
SHA512

3cb0ab3f34ecd37cd6d5aa15d35005368d45113ad49f745af9fc6e8591408b79cb14354b87d1bfb1c615f886ab1d1f0e6b4ef386bfed12b7fc1676aaf88d7e24
SSDEEP

12288:oxjj9vebpqQT3SYPlmVUXZRp0f1mpJZLY3YAworgij0nbMPPdPwD4mvhwI:UOsY/094JZDK0bMPc4m5wI

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 2280	1908	rundll32.exe	31
PID 1908 wrote to memory of 2280	1908	rundll32.exe	31
PID 1908 wrote to memory of 2280	1908	rundll32.exe	31
PID 1908 wrote to memory of 2280	1908	rundll32.exe	31
PID 1908 wrote to memory of 2280	1908	rundll32.exe	31
PID 1908 wrote to memory of 2280	1908	rundll32.exe	31
PID 1908 wrote to memory of 2280	1908	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$0\basicscan.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$0\basicscan.dll,#1
  2⤵
  PID:2280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads