1e4519b90828e71ac7b3f6e6eeb3463a02462640433e6b384206cf852931c4a4 | Triage

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 05:12

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/Setup.dll
Size

70KB
MD5

ceb233fa36d2f6dd6a4f4058a453d462
SHA1

c254ab2371c415d956613a2c6acb277c16d906fe
SHA256

1313e4399fcec8c6fd0928a8b9a8814cdc7dc31906bf173edf79adaf2ac2d74c
SHA512

8bbb3f3f9205cc1134484c03ce4623eb7440893707f56ffb79b36eb794d9044d90fbf953445e3c1fe47cc6aa38d4eb4acb8f180096d0ebde0e9b50fea014f734
SSDEEP

1536:AsyccnG+3ONTVIw8fe56H8GDOMVekcMHWItT:A6Ipe51NaiMHWIt

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2368	2376	rundll32.exe	30
PID 2376 wrote to memory of 2368	2376	rundll32.exe	30
PID 2376 wrote to memory of 2368	2376	rundll32.exe	30
PID 2376 wrote to memory of 2368	2376	rundll32.exe	30
PID 2376 wrote to memory of 2368	2376	rundll32.exe	30
PID 2376 wrote to memory of 2368	2376	rundll32.exe	30
PID 2376 wrote to memory of 2368	2376	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Setup.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Setup.dll,#1
  2⤵
  PID:2368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads