17d4b4135f2aaf7bb962d88a637972877074815da8e37e104f1d76aedb99116e | Triage

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 13:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

x64/PlugIns/ES-CoreMachines.dll
Size

835KB
MD5

b94b0ff26acab722c6d0c38aa97a7c09
SHA1

487029b88f85a4542039f1ed911b005b9f50c303
SHA256

4296a58bd15feefdc662d3f92214ecbd68c3749e6886e17bc156c969eef07457
SHA512

5dee53218348acb5f779b839898cd5e35b0feb0f410c84b992ecadd2bd96de2ae6c28a08ab08ff45abd5fbfb5e12c912fa2de4db06c545880f131d8b8ee4257d
SSDEEP

24576:XN2IhLCXCCCCCoT00/T+uQR4mPMAp68AD/KPNgn:XN2Ih2XCCCCCoTvTED9Y

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2676	1984	rundll32.exe	30
PID 1984 wrote to memory of 2676	1984	rundll32.exe	30
PID 1984 wrote to memory of 2676	1984	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x64\PlugIns\ES-CoreMachines.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1984 -s 144
  2⤵
  PID:2676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1984-0-0x000000006A8C0000-0x000000006A999000-memory.dmp

Filesize
868KB

Download