c9552e4006aa4d1107c2bf7a5b8270bac4e440bfe10a4214d690019a5a969232 | Triage

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 23:01

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/OnTop.dll
Size

3KB
MD5

7c0c240e911a521e8e554a10d04e558f
SHA1

d12ca9c464f2764e211039c09e56cb347626f7c7
SHA256

28cf47c05c86b2264ea1da120d3644cb46c86d6f27072a9a853e63e05ec97a25
SHA512

579b6787061efdc7f618f3c5a513cb539ccbe12ca41ba5e9ba8f00d03600edcdd82262b0fbfd58b96231c461f18b1233d657cbd0d1b827ea9df5374508578707

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 1544	1424	rundll32.exe	31
PID 1424 wrote to memory of 1544	1424	rundll32.exe	31
PID 1424 wrote to memory of 1544	1424	rundll32.exe	31
PID 1424 wrote to memory of 1544	1424	rundll32.exe	31
PID 1424 wrote to memory of 1544	1424	rundll32.exe	31
PID 1424 wrote to memory of 1544	1424	rundll32.exe	31
PID 1424 wrote to memory of 1544	1424	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\OnTop.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\OnTop.dll,#1
  2⤵
  PID:1544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads