41b3b4d0354bac1bf819f1ec29b147a08df1fc05cf5f8cd7079101f51b287c26 | Triage

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 17:38

Sharing

Report Analysis Logs

General

Target

leveldb.dll
Size

385KB
MD5

606378bbc6ed8f1038a4bcac411b99e5
SHA1

edeb97710788dfaff5e415917ad7b7f762d2fd79
SHA256

853939baf1391a7a73d3ec6fd0ee8b36e2ef200ea1a8aa70090a83944e5ddac2
SHA512

80fbd6d94b1e1b718f95b80974013999402d94b6a7da259954bb23a4e111f61b9c59ec76a59716bbf0da429a6e1e2825371064f11afd19fcc33787d324454ad4
SSDEEP

6144:I0QdQjA4JpvdnnF8NXuF3PQ7FZnajqpWSq:s4JpvVeSQ7MqpS

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 1320	2148	rundll32.exe	30
PID 2148 wrote to memory of 1320	2148	rundll32.exe	30
PID 2148 wrote to memory of 1320	2148	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\leveldb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2148 -s 80
  2⤵
  PID:1320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads