e156f0d787a2a3f6f90a144aee897febf467cf12cb41d912c7246c64cdaba8f1 | Triage

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
25-08-2024 19:58

Sharing

Report Analysis Logs

General

Target

x64/trading_api64.dll
Size

282KB
MD5

2bca4e2c047ec969cb3cff277e7fc184
SHA1

c4b5b00b605e59c6fdcb6731f2e53069506e287a
SHA256

f1eb582e607a1e43cdb1654bfb7cb29ad46f6728b3fb89a14f7727e0e8daab69
SHA512

3819178ec650298157b1d67317e0895cb92709b106d0d8525921e341eba5e960f42434e010066bb405f1ba1619adff1a645ede58e16c4b2d88df2c90611a6cb5
SSDEEP

6144:Aa0EKzmilQBrUssevOkHcAxilMrCynC0bcLd1x:B0EZbr3se1SynC9x

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2700	2324	rundll32.exe	30
PID 2324 wrote to memory of 2700	2324	rundll32.exe	30
PID 2324 wrote to memory of 2700	2324	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x64\trading_api64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2324 -s 116
  2⤵
  PID:2700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads