ce27061cd0f707eed21d820be9d086fe0b313e6d93f735d4600126e3fb73dcf7 | Triage

Resubmissions

08-09-2024 09:49

240908-ltpd4aygpj 6

07-09-2024 21:53

240907-1rsq3axcrn 3

07-09-2024 21:50

240907-1qbq6axckp 3

07-09-2024 21:47

240907-1nltcazblh 6

07-09-2024 21:46

240907-1mtskazbja 3

07-09-2024 21:44

240907-1lm9dszalh 6

07-09-2024 21:41

240907-1jybksyhpc 8

Analysis

max time kernel
1190s
max time network
844s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-09-2024 21:53

Sharing

Report Analysis Logs

General

Target

DDoS-Ripper Pro/pytransform/_pytransform.dll
Size

1.1MB
MD5

41e4a13fe6da012977223734237f4548
SHA1

7e66a8f08b96505e16520a01d5cbb72e06491d2a
SHA256

a200030feb7d83b39d249f1e39141b34234437780842cc4f4869edd2f253d435
SHA512

6a37b0fd3202558c000c8426d6914956604ab583e837c3033a962fe2ce8b31f5c7c240b0b7c7c19d2f8e18e5d60eaef9983995e675abaae954182ad3f97ce980
SSDEEP

24576:4tMBvpcZzdcZ7fUoPOSJiV9nZdencCnQBR:VvpcdPZsn4R

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 1736	2512	rundll32.exe	30
PID 2512 wrote to memory of 1736	2512	rundll32.exe	30
PID 2512 wrote to memory of 1736	2512	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\DDoS-Ripper Pro\pytransform\_pytransform.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2512 -s 88
  2⤵
  PID:1736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2512-0-0x0000000070A00000-0x0000000070B2E000-memory.dmp

Filesize
1.2MB

Download