5e0fe9a36971219aa084dffc624b2a383e8e00984aada882e1f75e0e81804a26 | Triage

Analysis

max time kernel
15s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29-09-2024 13:30

Sharing

Report Analysis Logs

General

Target

baselib.dll
Size

409KB
MD5

e6bf25af5ded100e8122d3c247c295ae
SHA1

07ab0ff0226036f6848854dc1bd0f2520e2a2bd1
SHA256

5e0fe9a36971219aa084dffc624b2a383e8e00984aada882e1f75e0e81804a26
SHA512

e950fd0f5ed41c74edb79e8d2cbbf3a1c86f0ca79af508f9ae21acf075d98d8fcb5d8624025c25f1c9f29e94b8b68c22286cc68328db96f3b381bd8e60f180e6
SSDEEP

6144:UuInkY6mJtoLpzxkzt0R60Htptb+REDqDY92q31YM9Ci4DTFY9GiXTnDq:TInZ6mXWM0NptoDY92qFn9V7Dq

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2516	2092	rundll32.exe	30
PID 2092 wrote to memory of 2516	2092	rundll32.exe	30
PID 2092 wrote to memory of 2516	2092	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\baselib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2092 -s 80
  2⤵
  PID:2516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads