000abc24d378fefbbee9e4466a200f4088e63c941bb7ecba18af54d6e23fecfa | Triage

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-11-2024 02:00

Sharing

Report Analysis Logs

General

Target

x64/trading_api64.dll
Size

282KB
MD5

2bca4e2c047ec969cb3cff277e7fc184
SHA1

c4b5b00b605e59c6fdcb6731f2e53069506e287a
SHA256

f1eb582e607a1e43cdb1654bfb7cb29ad46f6728b3fb89a14f7727e0e8daab69
SHA512

3819178ec650298157b1d67317e0895cb92709b106d0d8525921e341eba5e960f42434e010066bb405f1ba1619adff1a645ede58e16c4b2d88df2c90611a6cb5
SSDEEP

6144:Aa0EKzmilQBrUssevOkHcAxilMrCynC0bcLd1x:B0EZbr3se1SynC9x

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2124 wrote to memory of 680	2124	rundll32.exe	WerFault.exe
PID 2124 wrote to memory of 680	2124	rundll32.exe	WerFault.exe
PID 2124 wrote to memory of 680	2124	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x64\trading_api64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2124 -s 116
  2⤵
  PID:680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads