9737c963c888d2df3b767ef7c77265c47decabc4b71210146be9e9f81914ecf0 | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-09-2024 09:42

Sharing

Report Analysis Logs

General

Target

CRYPTSP.dll
Size

282KB
MD5

9969eec1d2e99a6535f5fc62b2acc78e
SHA1

212b0d900473ff811bd6d4f1dbd2a2f732574763
SHA256

27a1a83fc410bb51c4fa943de18fc93f1081a5703941808e01a12ef176735c4e
SHA512

9ea50296718ebccc4a9bfcc2fce61e47b74c00febf4f50dd159c4852fbdf4a2fa06cd0fdbdfde653078c4763b8b4917b43499aa671dd2b2ca30029f8c3abeb14
SSDEEP

6144:e5yKlTiyDU15/TKvqXNBfPmLno+bG+4ohEzP+59:e5ni7//+6feLTGroiK9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 2092	2920	rundll32.exe	28
PID 2920 wrote to memory of 2092	2920	rundll32.exe	28
PID 2920 wrote to memory of 2092	2920	rundll32.exe	28
PID 2092 wrote to memory of 3004	2092	cmd.exe	30
PID 2092 wrote to memory of 3004	2092	cmd.exe	30
PID 2092 wrote to memory of 3004	2092	cmd.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CRYPTSP.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c calc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:3004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads