cf44f5c1dc5bfccb23436149f3de5f4292fc141a9ec7f5349c5e31b2b483c176 | Triage

Analysis

max time kernel
14s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 11:52

Sharing

Report Analysis Logs

General

Target

x64/tesseract53.dll
Size

2.6MB
MD5

273038c2b425b6b089a172efca63e128
SHA1

288fe02355f1da5102645f7743ebd9934ea6871f
SHA256

bd5444629d4bbe297c3bde98efbc9c0ffe8eb2660a0b051d44841b7fd2430a39
SHA512

9f34bafaa997394f835671b365b526a6dae666e1d09d03bc6342671eee1b16ffe97036799cefb7d9e040042ae4c0ff813296480937d6c3fd43e7e0fda99e1f27
SSDEEP

49152:4sqZW+PFy5JRo1NFtzVnqwnC1bGnlVl//vV9qdx20FH6dk6UV+:tcDZjAKntgZz6UV

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2496	2508	rundll32.exe	30
PID 2508 wrote to memory of 2496	2508	rundll32.exe	30
PID 2508 wrote to memory of 2496	2508	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x64\tesseract53.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2508 -s 80
  2⤵
  PID:2496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads