b5a7df1bce14af47db87f45e2ee5c2f53408d181da89d3490298e49714902a03 | Triage

Analysis

max time kernel
9s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 08:52

Sharing

Report Analysis Logs

General

Target

FlashPlayerControl.dll
Size

317KB
MD5

bbb06303cdc44cb30a4aa6f75cdbb3c4
SHA1

2e04e0748bcb3879819f7da7e9879a3762e768f8
SHA256

c294a60155614ad81bf749f3be8734a66ed4286aaca943f5c490269bbca066b9
SHA512

797307e5bec363621a9ebe750c846fca145ae4b297e0a320fbc2911bf0087a570777c491d3fc6e223ffe711145c6cddaa52459401216109a55b85e0e1a7e6497
SSDEEP

6144:Zkc4lY1zJ7nnJ9W5G6ZzRUM+lgG8q4nu7nIH+z:+HlMzJnW5G6dRUM+l1pou7n

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1696	1732	rundll32.exe	29
PID 1732 wrote to memory of 1696	1732	rundll32.exe	29
PID 1732 wrote to memory of 1696	1732	rundll32.exe	29
PID 1732 wrote to memory of 1696	1732	rundll32.exe	29
PID 1732 wrote to memory of 1696	1732	rundll32.exe	29
PID 1732 wrote to memory of 1696	1732	rundll32.exe	29
PID 1732 wrote to memory of 1696	1732	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FlashPlayerControl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\FlashPlayerControl.dll,#1
  2⤵
  PID:1696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads