bd596b7c49cb63c8b73a815c4eceb0149ccaee34d124dc9cf5e5c5304dde7a5f | Triage

Analysis

max time kernel
13s
max time network
18s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 02:53

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/mIRC.dll
Size

23KB
MD5

37951d5d14c5b7d41899bfe3bcf965b8
SHA1

3f429c58188753ce59ef159785c468790955a821
SHA256

41e306c9396301950b4ed6e961736f70514fa57c9d872da11416e09fd0af50ee
SHA512

ba714c83eb2b89e353344b45949090e367b53ab04251ed316c43af60340e3f0d47323b15f4f9929c48910ac18e78178fb4f4dfa1f366ffbcdb6186eb3df15027
SSDEEP

384:w9OMMDa6kKNvS9ig5R6bTEsfvdFA0ku8i8oo4uGPGc5lT:wjM+Ng3Es3dFAdiD1Oc5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 428	2260	rundll32.exe	29
PID 2260 wrote to memory of 428	2260	rundll32.exe	29
PID 2260 wrote to memory of 428	2260	rundll32.exe	29
PID 2260 wrote to memory of 428	2260	rundll32.exe	29
PID 2260 wrote to memory of 428	2260	rundll32.exe	29
PID 2260 wrote to memory of 428	2260	rundll32.exe	29
PID 2260 wrote to memory of 428	2260	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\mIRC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\mIRC.dll,#1
  2⤵
  PID:428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads