5f20af1d782468507417d0785826b1f064fadba88ed1691e2def269922ace56b | Triage

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 23:14

Sharing

Report Analysis Logs

General

Target

libgig-6.dll
Size

801KB
MD5

2a7e2c316655fcbbbe3d51f2cced6ef9
SHA1

60bdff72a5029f9743f9fc1e8be95ccc4b41f89f
SHA256

3200b9740378b60df71076341af06d67d4ca3086219dea6c3a9d08b8d30d8620
SHA512

106c8c79bd833ddd8c5c55eeea8142e67ae26347c1b3c280371f8512fe65e473eb71f0b0dc040899c5ecc79e219b3f60b5c46c5fc68e859909825346d328fdf9
SSDEEP

12288:Qc+GVNYzEJek9LRa/GTW+bBWGzdx8UmF96Lzc5y4xPs:1VIyekW/GTW+bBrdC796nc5y4xPs

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 2400	816	rundll32.exe	31
PID 816 wrote to memory of 2400	816	rundll32.exe	31
PID 816 wrote to memory of 2400	816	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libgig-6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:816
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 816 -s 84
  2⤵
  PID:2400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/816-0-0x0000000065B00000-0x0000000065BCF000-memory.dmp

Filesize
828KB

Download