c326b43d538c562ff7e613f19773147a0395740c864a4bcdbdcbc1c9a3c3716f | Triage

Analysis

max time kernel
14s
max time network
20s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/08/2024, 17:49

Sharing

Report Analysis Logs

General

Target

₳DÐ✵SetUp✓/x64/trading_api64.dll
Size

282KB
MD5

2bca4e2c047ec969cb3cff277e7fc184
SHA1

c4b5b00b605e59c6fdcb6731f2e53069506e287a
SHA256

f1eb582e607a1e43cdb1654bfb7cb29ad46f6728b3fb89a14f7727e0e8daab69
SHA512

3819178ec650298157b1d67317e0895cb92709b106d0d8525921e341eba5e960f42434e010066bb405f1ba1619adff1a645ede58e16c4b2d88df2c90611a6cb5
SSDEEP

6144:Aa0EKzmilQBrUssevOkHcAxilMrCynC0bcLd1x:B0EZbr3se1SynC9x

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2716	2304	rundll32.exe	29
PID 2304 wrote to memory of 2716	2304	rundll32.exe	29
PID 2304 wrote to memory of 2716	2304	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\₳DÐ✵SetUp✓\x64\trading_api64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2304 -s 120
  2⤵
  PID:2716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads