1d2bd211b2cb977bbb59c139387096ab73e1496eb5f6ad1237d8fe7878124872 | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23-07-2024 08:15

Sharing

Report Analysis Logs

General

Target

Rc7 - Cracked/Rc7.dll
Size

4.6MB
MD5

882d31a38dbc169e51395f71f0eff5f1
SHA1

0740b7158f86b98c45738b6b325e42a7f106fedf
SHA256

1ca54533be8464d8a2275bf252cd619ee2c1d80f2023125b180af3aaaa8f64d6
SHA512

6b7d80d3b26199a33c0d095e95792af88fef9a218bca853f009e4646297981f75ee54e99d54cc9b1530aa75978e8e6edd6d71386d7a20b8525690c4c13cb6c37
SSDEEP

98304:lVQx8t9hlqVUZWNP9GJ3yL0wNHEmNL+MLOYTJh03QBEx+:lwSZ2YJ3ENNVNLJSYTj0g2x

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 3028 wrote to memory of 2184	3028	rundll32.exe	30
PID 3028 wrote to memory of 2184	3028	rundll32.exe	30
PID 3028 wrote to memory of 2184	3028	rundll32.exe	30
PID 3028 wrote to memory of 2184	3028	rundll32.exe	30
PID 3028 wrote to memory of 2184	3028	rundll32.exe	30
PID 3028 wrote to memory of 2184	3028	rundll32.exe	30
PID 3028 wrote to memory of 2184	3028	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Rc7 - Cracked\Rc7.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Rc7 - Cracked\Rc7.dll",#1
  2⤵
  PID:2184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads