816678f27a605539befc4304ad9d82a8b95a6292180616de67b5861e0cd0a44e | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 03:27

Sharing

Report Analysis Logs

General

Target

Isdjek.dll
Size

10KB
MD5

736d1bc5cb5ad0af70d6a94b768f2803
SHA1

5cd2f1e890d3f493dc61c05130c8ca2979ee0bb4
SHA256

1bba6e6e13f028e67d529d52e3614b607536f718b5d8e0aa6cd98f1aa15101b7
SHA512

909e33ffdbbe3c6f797e3eea14d5722addbbe3e5c9cb085dc2edbd8d69942de3d6dd58a57f5476a5e255b80b50869a516814b1b9791c388a2fb7749ca246cbff
SSDEEP

192:aM4myTKvnKiCON7bop/HuOaAn6MsdHGlK3cn84M2Wk7I9Hb2t:2rmCCopWO7nBnlGc8I7I9H

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2276	2252	rundll32.exe	30
PID 2252 wrote to memory of 2276	2252	rundll32.exe	30
PID 2252 wrote to memory of 2276	2252	rundll32.exe	30
PID 2252 wrote to memory of 2276	2252	rundll32.exe	30
PID 2252 wrote to memory of 2276	2252	rundll32.exe	30
PID 2252 wrote to memory of 2276	2252	rundll32.exe	30
PID 2252 wrote to memory of 2276	2252	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Isdjek.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Isdjek.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2276-0-0x0000000075120000-0x0000000075126000-memory.dmp

Filesize
24KB

Download
memory/2276-2-0x0000000075120000-0x0000000075126000-memory.dmp

Filesize
24KB

Download
memory/2276-1-0x0000000075110000-0x0000000075116000-memory.dmp

Filesize
24KB

Download