84af6da5dda3d5b08c600f5f29566d62ec4d06e45a9aea4eca29a2d66b0acc91 | Triage

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29-10-2024 09:14

Sharing

Report Analysis Logs

General

Target

x64/trading_api64.dll
Size

282KB
MD5

2bca4e2c047ec969cb3cff277e7fc184
SHA1

c4b5b00b605e59c6fdcb6731f2e53069506e287a
SHA256

f1eb582e607a1e43cdb1654bfb7cb29ad46f6728b3fb89a14f7727e0e8daab69
SHA512

3819178ec650298157b1d67317e0895cb92709b106d0d8525921e341eba5e960f42434e010066bb405f1ba1619adff1a645ede58e16c4b2d88df2c90611a6cb5
SSDEEP

6144:Aa0EKzmilQBrUssevOkHcAxilMrCynC0bcLd1x:B0EZbr3se1SynC9x

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2184 wrote to memory of 2224	2184	rundll32.exe	30
PID 2184 wrote to memory of 2224	2184	rundll32.exe	30
PID 2184 wrote to memory of 2224	2184	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x64\trading_api64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2184 -s 116
  2⤵
  PID:2224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads