b88eba51614aaa61dcfbfab6fd7e7a9253a67e9bb6f6c6c830c0935f1998128b | Triage

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 18:37

Sharing

Report Analysis Logs

General

Target

L@unnchsr/VBoxRT.dll
Size

6.9MB
MD5

9c96fc3d4616816a7655fdba0d3d5722
SHA1

d26575af4ef0ee2034efd49b1b44c55ebc02f34e
SHA256

ff6299343ba95ba302e15ae06c756f2b1aee26980e8d781f1c1766f2cb432d28
SHA512

15135ce9e6f63acb724fb87e6762f38ed5ab18ba14d6bff7f910283ce48d78a16fabc080b999338ac1ca7a504c7f69d2bd1853a1de4a5c87cfde6bc67f5d6672
SSDEEP

98304:Ol++bCDgegT6SG38sjwyKyg+NjA4+6Wn5J7liYcp4oFC:sRbCDgew6SG3ljwQFJA4+JnT7lGD4

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 1272	2156	rundll32.exe	30
PID 2156 wrote to memory of 1272	2156	rundll32.exe	30
PID 2156 wrote to memory of 1272	2156	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\L@unnchsr\VBoxRT.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2156 -s 92
  2⤵
  PID:1272

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads