910bc0e0e5afd7669cfd1932606e30484751c5cd8de63d37a39716bc039c5317 | Triage

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-10-2024 17:11

Sharing

Report Analysis Logs

General

Target

setup-x86_64/Cryptodome/Cipher/_raw_ofb.dll
Size

12KB
MD5

bd385b4d447711a590f69b631caa65df
SHA1

5ac9f44043cec1049129af9cbe48fc678b3fc1a0
SHA256

e5247aaee8849bd50cd6f956ff7ae73dee8bcb14cdbac63de2bd8fcd8d5898d3
SHA512

f430d43cd87611a88df305808e246454499b5f3fc53481104afbafc00a2638ea88b32d39a556f5fdaaf1099e65c73680c70213c2f51c588bb370fc18fd6b7210
SSDEEP

192:MF/1nb2eqCQtkgU7L9D0c70fcqgYvEJPb:G2P6L9DBAxgYvEJj

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 1924	552	rundll32.exe	30
PID 552 wrote to memory of 1924	552	rundll32.exe	30
PID 552 wrote to memory of 1924	552	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\setup-x86_64\Cryptodome\Cipher\_raw_ofb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:552
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 552 -s 80
  2⤵
  PID:1924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads