bc611b06c52dfdadb32a632388e7ea1122eabdbb4da5712c48c877712e48bcbb | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 20:21

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/installhelper.dll
Size

296KB
MD5

599f9db17bc1bb21ae7d621ba18c7b0b
SHA1

517982eded11fca77b619e6440f1a02e510b215e
SHA256

02e43c366ddd5e2e6237292b232b09c0df993a88406079c202b3d865c472da4a
SHA512

4451539b1fec010921338c170c2fc0197ce5ff019b87f1eba3ae6e779263ad210ff911d1a5108051c3010a53f0a29a3816c6fb3abe4ae19407e6c4ca008fba7c
SSDEEP

6144:4aeBlMKhLJ1ijM23pzNUEAO+FjxvxnrSFDoDVOyfPA:EMwkM230ETWjxvB+VynA

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2112	rundll32.exe
2112	rundll32.exe
2112	rundll32.exe
2112	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 2112	1540	rundll32.exe	30
PID 1540 wrote to memory of 2112	1540	rundll32.exe	30
PID 1540 wrote to memory of 2112	1540	rundll32.exe	30
PID 1540 wrote to memory of 2112	1540	rundll32.exe	30
PID 1540 wrote to memory of 2112	1540	rundll32.exe	30
PID 1540 wrote to memory of 2112	1540	rundll32.exe	30
PID 1540 wrote to memory of 2112	1540	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\installhelper.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\installhelper.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\INSTALLHELPER.LOG

Filesize
1KB

MD5
a774cefba4314e099758b202b303ac74

SHA1
9dbb972900e442e7f4f920753aaac754e9403d70

SHA256
470ca4d91730ea7ba949f3e509c5a1a31330fac1443d79069c5db82e8a6af5c9

SHA512
48002e8cd383832a96ca856238dabc44b1db9a0bdbd24ec7feb591cdfd017abc4e96509a26da092255c6ca0a36b003a841fba992d4eee4492799fd128ed8e5a2

Download Submit