bb227aa7b0404ccac254372c91ddf2e307526aa82ed9c4ecd3e495c38a6b4552 | Triage

Analysis

max time kernel
17s
max time network
19s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 08:31

Sharing

Report Analysis Logs

General

Target

MedicareSign/aw_sas32.dll
Size

17KB
MD5

acf7048e2347cfd66cd17648dbfbaf45
SHA1

df5a12e399176771dc8cf2f7d0cf5548e41e2bb3
SHA256

f1cffbc2ada8491755c76360aad14314deb576aa65f503e52fa24dee7d33d8e7
SHA512

51a53cb700fbb7abf3bda3101ed0885572460c1686d07c3d2125c8aa6f0834e30528bee78cc40ee9270714a16ac769d16f5a916f37f0e48bbf7121202e58e0c0
SSDEEP

384:ZPkFNiOMTd1th9gQIim+4vBDVU376TFNiWC:iNhMpXgIr4vBBYANi1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 2244	1896	rundll32.exe	29
PID 1896 wrote to memory of 2244	1896	rundll32.exe	29
PID 1896 wrote to memory of 2244	1896	rundll32.exe	29
PID 1896 wrote to memory of 2244	1896	rundll32.exe	29
PID 1896 wrote to memory of 2244	1896	rundll32.exe	29
PID 1896 wrote to memory of 2244	1896	rundll32.exe	29
PID 1896 wrote to memory of 2244	1896	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MedicareSign\aw_sas32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MedicareSign\aw_sas32.dll,#1
  2⤵
  PID:2244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads