c88a22dae5d5564a33736d8cd43835eb46153bafe47fc6e8c267c3b89d4abf04 | Triage

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 17:38

Sharing

Report Analysis Logs

General

Target

Bin/1T4C8T2M97M56U598G3NSHJ1P4GL9ULE.dll
Size

34KB
MD5

0e0abe3ce70ab397a8f6959c153ee34d
SHA1

0f48c4745649ec5378a944077e4661c92154faae
SHA256

4cab978c8e847322007cb897466dd1bed69445e6e62eb97423ac518709bcd5b9
SHA512

e3d39d77dbd8302bee23018208a19d1112c3e969c609f469d65d95ca809bdaba7260751393022e8650ec55b34aa09d5ed43eee14fb3410d30f6d0a9b36363840
SSDEEP

768:QnT15SFDIH5kwAOFnIKtDGJEJPxfUwDGK3hOvA:QsIZkwAOlTPxfUe3hOY

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 1272	2060	rundll32.exe	30
PID 2060 wrote to memory of 1272	2060	rundll32.exe	30
PID 2060 wrote to memory of 1272	2060	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Bin\1T4C8T2M97M56U598G3NSHJ1P4GL9ULE.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2060 -s 80
  2⤵
  PID:1272

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads