43dd818938f2a189ae43dcaffa558ad39d518aa60ac096f0cdc0f1c35677a249 | Triage

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 18:35

Sharing

Report Analysis Logs

General

Target

Icons/proto_ICQ.dll
Size

22KB
MD5

5aff6c0706434196385a80ea901ac4fe
SHA1

7a4e6ae0956b68f27f9924f91dcd430975ae4327
SHA256

cf514e4fa21549db4136ed794d00bb70e997a001f0a6284349eb88fdc7e6cb9c
SHA512

dda0be95b4191d42e6c400c2628b60bc251dd6b4717763f2ad6996bc90e64e695eb55ec2d9a06264f646efc651071645d007cb3ec298f47396668a6843ba07ef
SSDEEP

384:uRR8HTD3ssY3JxOt0EVK2VnLRdi782PdyRn:uD8HXnwJxOtJVK2pDiYR

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 592	1636	rundll32.exe	29
PID 1636 wrote to memory of 592	1636	rundll32.exe	29
PID 1636 wrote to memory of 592	1636	rundll32.exe	29
PID 1636 wrote to memory of 592	1636	rundll32.exe	29
PID 1636 wrote to memory of 592	1636	rundll32.exe	29
PID 1636 wrote to memory of 592	1636	rundll32.exe	29
PID 1636 wrote to memory of 592	1636	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Icons\proto_ICQ.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Icons\proto_ICQ.dll,#1
  2⤵
  PID:592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads