06c2dff99c92ad35dc3b83ac8608002a5b0fe080fcd9d321c223ed1a31267d61 | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 08:13

Sharing

Report Analysis Logs

General

Target

xxhash.dll
Size

46KB
MD5

249a5f6ca047df2a2f802782696c7f80
SHA1

6a1d96be0f497d689fb55de70284af83cac61f52
SHA256

2828e3014c3283caeb1b00d14145a42f4e347e7f547b40634540394892265671
SHA512

d2d0b6ba2ec95c33609d98788e5a4cce382d93721ea5dea61cde3f4c065b06530a0b01ae4909f7883a81d55529a36cb6a5820aa2afc320b5761f6f59a3a45f1f
SSDEEP

768:zziPp7yW4k3QDn24NuDUSu0MKQVMNKuxYAuogba4Mk3QimeSyygGz1K:zziR74kgDn2rDRuIrN5mAvgbTgi3SylI

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2300	2692	rundll32.exe	30
PID 2692 wrote to memory of 2300	2692	rundll32.exe	30
PID 2692 wrote to memory of 2300	2692	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\xxhash.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2692 -s 80
  2⤵
  PID:2300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads