8fb0ce88b39069c7424c64ab9d30b3b8daa5da9fdb72a52d31f45b494a8eadcd | Triage

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
14-08-2024 14:20

Sharing

Report Analysis Logs

General

Target

data/meterpreter/ext_server_incognito.x64.dll
Size

107KB
MD5

09183390eca3592102cf339ac12fdfe4
SHA1

033030ce69159cef63e15580679f02f239463571
SHA256

42e4c89df735ed63f8050fe858409f2a3a17967b2b0082ab4f60ceac92e0c52b
SHA512

8b26b088bf60b90cd58c8f89d11a67f929ea35aa0a003efe17469ae28201e292eca68212226e804a36509ca9d7881cff09d43d52371fa51ff0b853655d90f8a9
SSDEEP

3072:hCZVufqShTYjlT1Jr4KGZAWdxW51y6Vdlb:8Vu7hTylxJ361+5R

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 968	2928	rundll32.exe	29
PID 2928 wrote to memory of 968	2928	rundll32.exe	29
PID 2928 wrote to memory of 968	2928	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\data\meterpreter\ext_server_incognito.x64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2928 -s 128
  2⤵
  PID:968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads