bd99084ecea6b27f078ae62e8e4b47c5ebeac32265325d4e30df9a65cbc1ace1 | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 10:19

Sharing

Report Analysis Logs

General

Target

ODimg.dll
Size

116KB
MD5

92756208fe9138d360f2beb68d5ca349
SHA1

5359b0f6f342c36b586b555e0c2ca65dd7715508
SHA256

f551f27a4a9bbdbbbbcadd4ba43c6165e1f17bf5273fac339972673cd2b9bbbc
SHA512

d9549ca6562017d98121b8ac093d0ec1de6786a7b435c43163ea06bb724d6014ccad7e91c102f369e9d586dcac412ae8c768ffd4a1fedfed8a08b1a1d8531770
SSDEEP

3072:m/ekNHuu7IqaltFiuiEf0/rN4xg98mGi:m/WXqalPQ1o

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2512	2120	rundll32.exe	31
PID 2120 wrote to memory of 2512	2120	rundll32.exe	31
PID 2120 wrote to memory of 2512	2120	rundll32.exe	31
PID 2120 wrote to memory of 2512	2120	rundll32.exe	31
PID 2120 wrote to memory of 2512	2120	rundll32.exe	31
PID 2120 wrote to memory of 2512	2120	rundll32.exe	31
PID 2120 wrote to memory of 2512	2120	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ODimg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ODimg.dll,#1
  2⤵
  PID:2512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads