5dde351516155c3ec5f77c4b93018609d6beeb642a03f12d5da30f0e1ca9d410 | Triage

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
16-07-2024 06:46

Sharing

Report Analysis Logs

General

Target

CommonSpecialist.dll
Size

150KB
MD5

26dc5b273d817257941ef9264129736a
SHA1

8b120b6f966b76e57f7af4e7245f66241f5fc38b
SHA256

63bf8ea19ff5e70b7a3b69f280b771cce39b4c0cef449bd8ba2c8c6de1c8fb1e
SHA512

011f3b9d02145bc7c17f47cd22ef67667c71a3217246c4c1bad6f59ea34bb4d1acb44fc50c86158d1a56bd07693466bd401d2af2b01370338d3c37c17b7fc8cf
SSDEEP

3072:eLgfRn1L3ZvyE9/VZCzyOuB780R/TFraZP0Err:tpn1L3ZvrFVwzyOuB780lTcZPnrr

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2192	2160	rundll32.exe	30
PID 2160 wrote to memory of 2192	2160	rundll32.exe	30
PID 2160 wrote to memory of 2192	2160	rundll32.exe	30
PID 2160 wrote to memory of 2192	2160	rundll32.exe	30
PID 2160 wrote to memory of 2192	2160	rundll32.exe	30
PID 2160 wrote to memory of 2192	2160	rundll32.exe	30
PID 2160 wrote to memory of 2192	2160	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CommonSpecialist.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CommonSpecialist.dll,#1
  2⤵
  PID:2192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads