4bd4b32500a738691128a27978e2beb5bb29c1491526e6cfa575a4d16d5c07ef | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 10:35

Sharing

Report Analysis Logs

General

Target

$0/questbasic.dll
Size

868KB
MD5

fdca8a780e7dd6dc9e7ee4901adf4368
SHA1

d73e934de28e993d4193fec854cd82821d0a6f55
SHA256

6c1747632bd606b1340b671ce30fe532bfd106b11156693353e1aa23989f31ad
SHA512

7f26e84e31789cf8c31c4292c34c08d27a643d47434761fc7c9202b9e37821c9d60dbbbdcff590b1d5b479485c4e4febdd9263e59b1d1bf415a9e93ed5802e7a
SSDEEP

24576:PEOEJJ86BvC3/sauaGuZaDZmjTmQfRB3sZVlfJnk:8OiBq3wuZaDApRB3+k

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2872	2088	rundll32.exe	30
PID 2088 wrote to memory of 2872	2088	rundll32.exe	30
PID 2088 wrote to memory of 2872	2088	rundll32.exe	30
PID 2088 wrote to memory of 2872	2088	rundll32.exe	30
PID 2088 wrote to memory of 2872	2088	rundll32.exe	30
PID 2088 wrote to memory of 2872	2088	rundll32.exe	30
PID 2088 wrote to memory of 2872	2088	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$0\questbasic.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$0\questbasic.dll,#1
  2⤵
  PID:2872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads