089b9af9ccab56dc15339777ed6435b0aa9d12f1f50481a5342dbd61c4264da5 | Triage

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 06:39

Sharing

Report Analysis Logs

General

Target

LGBeanFile.dll
Size

225KB
MD5

57ce6253202d8e5de884416e3ecc8ddb
SHA1

6171c12f9ae2a9030548616381b6ec0bb66fb2c2
SHA256

0abaf30a34ededefae3e00398431ca82200c2d1b36dd021d136ce1b8511fd0b2
SHA512

a3957e5c1c2133ff888f7499b7412042526524df373b84e41dea1b3a3bb5e01fb8f405d9d241205070fd4587b5d16f935bade36fe5617bc25c3eb28045f592f9
SSDEEP

3072:CzZtjjM5xKOJ8WeW4gF7DhtfnJG/BVo7rsCHZ6LYivL5ZrMgv:CrjjM+OJoW4gFHhVJG/Xo7rjQr

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2724	2276	rundll32.exe	30
PID 2276 wrote to memory of 2724	2276	rundll32.exe	30
PID 2276 wrote to memory of 2724	2276	rundll32.exe	30
PID 2276 wrote to memory of 2724	2276	rundll32.exe	30
PID 2276 wrote to memory of 2724	2276	rundll32.exe	30
PID 2276 wrote to memory of 2724	2276	rundll32.exe	30
PID 2276 wrote to memory of 2724	2276	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\LGBeanFile.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\LGBeanFile.dll,#1
  2⤵
  PID:2724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads