939cdd940184fa0be3ac8de9330d66e144d93396098713278e736e6ab1396f72 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14-08-2024 21:19

Sharing

Report Analysis Logs

General

Target

spooferconfig.dll
Size

6.0MB
MD5

f553ad722875c02d5b45f5c975ceb771
SHA1

867f41aa5b67cf7e15e3efe6cb4360f8f415fa6e
SHA256

35f12093577d9c58fe7858ca26a935aaf409269057a9a8bdf975693d6dfe208a
SHA512

041924f9a64d626d1a3b7111de968f11cc08d384b9dcd47e832744bc195d71d6f58bf06cc9f14fcf31a2f1490230779d9a1afd70e8eb836424fd14d59e6f663b
SSDEEP

49152:Z9EWdahQOLgGyX6lRu6vz3ZLZh/qNwffAj3g/bTqSk6Fi0Lp5eo0Jvn:DaNFz3Z3/lgQ/6Sj5wv

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 772 wrote to memory of 2080	772	rundll32.exe	32
PID 772 wrote to memory of 2080	772	rundll32.exe	32
PID 772 wrote to memory of 2080	772	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\spooferconfig.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:772
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 772 -s 260
  2⤵
  PID:2080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads