34c35e5e18354f9e459e792a3f8bb40af5b18787f0461078ba563b5d49aa6292 | Triage

Analysis

max time kernel
13s
max time network
21s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 22:32

Sharing

Report Analysis Logs

General

Target

Clanwar1.0/GetIPLoc.dll
Size

205KB
MD5

5e84a30cd3566fee7a86d30088c6c516
SHA1

9ce63603cad67c9719a2c4af5b5468d9e652208a
SHA256

f3f69b5eae4d6d7035de8037fb5d26e9f8988146284ad0fc9fec258cf0480632
SHA512

45b8c0f75002226741cdfc3f4ed5b4b9d5e2a0fce7dcc3c511807e7ae706562923effa042a65f8e7c566a367f004d1049bef9b0895e900e62505603b8c0d89f2
SSDEEP

3072:EvKzxGq1l8ZRln0ymW8KJIJPLYSMXP6syO:uqf1yd0ymW52JPLYzXP6sy

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 2608	896	rundll32.exe	29
PID 896 wrote to memory of 2608	896	rundll32.exe	29
PID 896 wrote to memory of 2608	896	rundll32.exe	29
PID 896 wrote to memory of 2608	896	rundll32.exe	29
PID 896 wrote to memory of 2608	896	rundll32.exe	29
PID 896 wrote to memory of 2608	896	rundll32.exe	29
PID 896 wrote to memory of 2608	896	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Clanwar1.0\GetIPLoc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Clanwar1.0\GetIPLoc.dll,#1
  2⤵
  PID:2608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads