089b9af9ccab56dc15339777ed6435b0aa9d12f1f50481a5342dbd61c4264da5 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 06:39

Sharing

Report Analysis Logs

General

Target

LGBeanClean.dll
Size

265KB
MD5

702afd7cd174dd5630797bca9f638396
SHA1

d1e614cb6c50e2dfc7375095117adf0198ff3829
SHA256

6003095937a0ba9e9d0ca73c0f4b6bb18fafddf81bc6d26085b527b78ab404c3
SHA512

89c968cee37071c056bcbb20a6ed5b916f7bea83d757a51b0eb19d7c3032d325c218dda2813f85b65f845cd5f9d01122899a2a39baedacc66b28c8a4cfbb700a
SSDEEP

6144:paOA+RgnJhDYl0Sl07nUfHwBCqTSO2QcpERZY:pVRkJRY6UfHSCPO2Qcpb

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 1676	1924	rundll32.exe	28
PID 1924 wrote to memory of 1676	1924	rundll32.exe	28
PID 1924 wrote to memory of 1676	1924	rundll32.exe	28
PID 1924 wrote to memory of 1676	1924	rundll32.exe	28
PID 1924 wrote to memory of 1676	1924	rundll32.exe	28
PID 1924 wrote to memory of 1676	1924	rundll32.exe	28
PID 1924 wrote to memory of 1676	1924	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\LGBeanClean.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\LGBeanClean.dll,#1
  2⤵
  PID:1676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads