e8208b4ea0372e7708d867c4df307677ed6af1d1a10d87f1b2a8e02bd184b71f | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
06-08-2024 00:48

Sharing

Report Analysis Logs

General

Target

A FINAL DRAFT BL 00595854/jli.dll
Size

3.2MB
MD5

90d62a7d449acf1611f64271ae931c35
SHA1

ac20750a1ee03a1fff13b7059324ebe6914f88e0
SHA256

030894df7d8c8b08cbbade552f19e3975f7f97b2fd6b086c6a1dc6e807a12b60
SHA512

67842d26388fdfd5672491cbf7b80699d51b83ac40f939dabb2b8d568c25159e5329b25b2a4339acaedf3e8c706e10363e09c486202a69e2e6961e66ab6d3f3a
SSDEEP

49152:7Pnmb5cDLHDCGFEZEwMXQgFJ3Erj1cxgN:DmrGO5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 524 wrote to memory of 2404	524	rundll32.exe	31
PID 524 wrote to memory of 2404	524	rundll32.exe	31
PID 524 wrote to memory of 2404	524	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\A FINAL DRAFT BL 00595854\jli.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:524
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 524 -s 144
  2⤵
  PID:2404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads