cef9230ad3111e4a233e61b49ac977d4d25849061a90b05c3e7d6f308022b4de | Triage

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
09-11-2024 13:33

Sharing

Report Analysis Logs

General

Target

Rebel/Bin/Rebel.dll
Size

8.6MB
MD5

660d2429fc5f088bd197fb0958303936
SHA1

4189d1ba115f9e00caceb286f22655c6988e1eb6
SHA256

c9b95b9204234edfab46912d21953e3a6985a6b7d50c4fd63372e3d5361c7f3d
SHA512

9875fff045460f77dfc21cecd1de326d67778efd12fe8f53fc09bacfec807a9309752ed4bbb23653060fbee9152dd7c9a9bfda3a0c13c0375a1db932a02a197d
SSDEEP

98304:kz+S5QwKbQLCsjIpdUqsQf3/sfRMyxl5dn5Sz29f49EzFgfVp+t:WrS2LXjIpyDS3/0aWfmC

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 1224	2420	rundll32.exe	30
PID 2420 wrote to memory of 1224	2420	rundll32.exe	30
PID 2420 wrote to memory of 1224	2420	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Rebel\Bin\Rebel.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2420 -s 96
  2⤵
  PID:1224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2420-0-0x000007FEF4FC0000-0x000007FEF5853000-memory.dmp

Filesize
8.6MB

Download