6690c8fe22bef50e4ea21298c3dffee89f2d89cd2b2fc91c06c25bde5f0b549d | Triage

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 13:18

Sharing

Report Analysis Logs

General

Target

zip_contents/madHcNet32.dll
Size

921KB
MD5

2ba4099eb6fbac4eaae2d6dfe71b4e18
SHA1

fb6c32e1589cfa0121e15606932671f27ee963be
SHA256

8bd3edbf027972636bdb4cbb46037f0be98ca233e19b003e860af0bd7526a0ac
SHA512

953fe3a3328b871aac6ba9ce1242efa8e9d567f50eb22b3afee549ec9a83192b61ee479ddae44a5a63ee6594e8a73afda521f538f2e5eb750c15a00541864241
SSDEEP

24576:DlUbWq3/gquYUJ4Vgv0eUnDaE0eyxfcT9D:ZUR4quYUJ4VgceXE0ZxfAh

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2152	2476	rundll32.exe	29
PID 2476 wrote to memory of 2152	2476	rundll32.exe	29
PID 2476 wrote to memory of 2152	2476	rundll32.exe	29
PID 2476 wrote to memory of 2152	2476	rundll32.exe	29
PID 2476 wrote to memory of 2152	2476	rundll32.exe	29
PID 2476 wrote to memory of 2152	2476	rundll32.exe	29
PID 2476 wrote to memory of 2152	2476	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\zip_contents\madHcNet32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\zip_contents\madHcNet32.dll,#1
  2⤵
  PID:2152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2152-0-0x000000004A600000-0x000000004A6EC000-memory.dmp

Filesize
944KB

Download