d793a4581e3c84b3e492bdffaac29fb358363f0c2f4cfa00b67646f89725d54b | Triage

Analysis

max time kernel
1559s
max time network
1569s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 13:45 UTC

Sharing

Report Analysis Logs

General

Target

Bin/Rebel.dll
Size

8.6MB
MD5

660d2429fc5f088bd197fb0958303936
SHA1

4189d1ba115f9e00caceb286f22655c6988e1eb6
SHA256

c9b95b9204234edfab46912d21953e3a6985a6b7d50c4fd63372e3d5361c7f3d
SHA512

9875fff045460f77dfc21cecd1de326d67778efd12fe8f53fc09bacfec807a9309752ed4bbb23653060fbee9152dd7c9a9bfda3a0c13c0375a1db932a02a197d
SSDEEP

98304:kz+S5QwKbQLCsjIpdUqsQf3/sfRMyxl5dn5Sz29f49EzFgfVp+t:WrS2LXjIpyDS3/0aWfmC

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2968	2376	rundll32.exe	30
PID 2376 wrote to memory of 2968	2376	rundll32.exe	30
PID 2376 wrote to memory of 2968	2376	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Bin\Rebel.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2376 -s 112
  2⤵
  PID:2968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2376-1-0x000007FEF4F80000-0x000007FEF5813000-memory.dmp

Filesize
8.6MB

Download