66d98baccf204383ee64d744e01305be78428acb6218042f8bdea6bcda82a8b6 | Triage

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 17:26

Sharing

Report Analysis Logs

General

Target

Plugins/FX/reacast.dll
Size

418KB
MD5

a1b80484a7e489d41999148fc02ecb3f
SHA1

2de86c3d4cd94fde5406022690443711534f529f
SHA256

f29d3f78e21301dfabda772878b29de15eb10eb6f29acd65dbd006bcfef3ee75
SHA512

ef01c2a6b1765a2dfb080d8c9eca4df8242e6b09ceac591abc36aae3cb972c43a96786931606c8e621cd13ff3f168957f15e729d2f24c6e7f8f774b98e187ec3
SSDEEP

12288:w6Zb1R7P0rrvhK5c+8s18Eba+eB9JCxF:waVMrrvhK5c+8y8Eba+eB9q

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 1880	1884	rundll32.exe	28
PID 1884 wrote to memory of 1880	1884	rundll32.exe	28
PID 1884 wrote to memory of 1880	1884	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\FX\reacast.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1884 -s 80
  2⤵
  PID:1880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads