94191717090effe8e6f4e6b21169189cfde2efe0d3ab094089fb1c51c7d17870 | Triage

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-11-2024 21:59

Sharing

Report Analysis Logs

General

Target

Howl/backend.dll
Size

717KB
MD5

1f2cc0b1521e6227ba2694c992db36bf
SHA1

271a2168cf0b470e322657b30e78cea7089491d9
SHA256

48a87346fdb1bb26567dfbef82ae7e38032fd32b15344d080e8a97bb0455ba0b
SHA512

5d330b94096a98fce06fb4a65d0f497cacdb7c13838b0a737a59c83e71c8ea2441cebf922b4e539ad1ce1954e03da26cdf52475d637060523aad7ffe963ca1ff
SSDEEP

12288:L0ak2+olFra2fGwtrAxp0N7veDIrRzKb+rDTdjvcyO:L0ak2+olFra2fGwtrAD0htrRz2ODN0

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 1224	2360	rundll32.exe	30
PID 2360 wrote to memory of 1224	2360	rundll32.exe	30
PID 2360 wrote to memory of 1224	2360	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Howl\backend.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2360 -s 128
  2⤵
  PID:1224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads