1d1765f06c49e81d2935689775b0ee833f48d18b025792ec5b0dedc570c2dc1a | Triage

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 11:18

Sharing

Report Analysis Logs

General

Target

$TEMP/gtapi.dll
Size

77KB
MD5

4f379ae3ec96f6619c86fe6dac3e3cf5
SHA1

6cf1ccd5bb2a0b64da53b7d529847a2d6d9a7da5
SHA256

815f1171dd00afc46d26158bd7f9f95bb37c344252ca05afebfc51a8a3118b6b
SHA512

d5d9699cf06dc59858ed74c78ab2f922880bce1781b92f599bf382da8fe7425926454bb52ae6d6557923eacd3c3273d12b69246d8d81fa5669e3c69f2b2cfe32
SSDEEP

1536:qTLiIqREY/7Unf8EuohTotRLlAQRwSnk6qhNz:qTLipo0rRAQRwS2z

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2664	2028	rundll32.exe	30
PID 2028 wrote to memory of 2664	2028	rundll32.exe	30
PID 2028 wrote to memory of 2664	2028	rundll32.exe	30
PID 2028 wrote to memory of 2664	2028	rundll32.exe	30
PID 2028 wrote to memory of 2664	2028	rundll32.exe	30
PID 2028 wrote to memory of 2664	2028	rundll32.exe	30
PID 2028 wrote to memory of 2664	2028	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\gtapi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\gtapi.dll,#1
  2⤵
  PID:2664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads