aa63d723e0fde39bd468725d9ab31e22fded6f389399dc31f1ccf8bf87bee110 | Triage

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
28-08-2024 20:51

Sharing

Report Analysis Logs

General

Target

icudt56.dll
Size

23.9MB
MD5

67757a4c6c7d33f13fce4caa742d16c2
SHA1

ee1b2dc14b7b0465cac896ae1de7c9a566c90ba7
SHA256

3ba98aa7fad3af35592b4029442b45f43526d6b3273c75f3857fb28fed6b64f3
SHA512

0be3cab49217239aa901aaf44d9158c0650ea2dbaac01e7cc1850971e5e8230ca5baa734cfc1c389aeefb8ed0c7e1836be6e123a3b628702f4ad3151805a29e3
SSDEEP

393216:QKAzeR31BwiFvsiXUxew+fWhl1MUl2noOg9Wbkxy0MS/FT437T/0rPO2zj:IG3M

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 672	1676	rundll32.exe	30
PID 1676 wrote to memory of 672	1676	rundll32.exe	30
PID 1676 wrote to memory of 672	1676	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\icudt56.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1676 -s 80
  2⤵
  PID:672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads