ebf1f88870aadeb5f22a893b6670c6ac9aaccef37dad26317e000146e3cc8a41 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
03-09-2024 19:40

Sharing

Report Analysis Logs

General

Target

Rebel/Bin/Rebel.dll
Size

8.6MB
MD5

660d2429fc5f088bd197fb0958303936
SHA1

4189d1ba115f9e00caceb286f22655c6988e1eb6
SHA256

c9b95b9204234edfab46912d21953e3a6985a6b7d50c4fd63372e3d5361c7f3d
SHA512

9875fff045460f77dfc21cecd1de326d67778efd12fe8f53fc09bacfec807a9309752ed4bbb23653060fbee9152dd7c9a9bfda3a0c13c0375a1db932a02a197d
SSDEEP

98304:kz+S5QwKbQLCsjIpdUqsQf3/sfRMyxl5dn5Sz29f49EzFgfVp+t:WrS2LXjIpyDS3/0aWfmC

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2756 wrote to memory of 2828	2756	rundll32.exe	WerFault.exe
PID 2756 wrote to memory of 2828	2756	rundll32.exe	WerFault.exe
PID 2756 wrote to memory of 2828	2756	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Rebel\Bin\Rebel.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2756 -s 88
  2⤵
  PID:2828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2756-0-0x000007FEF5170000-0x000007FEF5A03000-memory.dmp

Filesize
8.6MB

Download