adacc03ecf3c2a0196c96067db10114b80f7ca106ffdcd849f05bb859641d1dd | Triage

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29-11-2024 02:30

Sharing

Report Analysis Logs

General

Target

DChat64.dll
Size

289KB
MD5

5b7c86306f1d0b546d1ec3564c13c14e
SHA1

557543cc2fc14f8b3ac4976e4f2c1f51a14e35ff
SHA256

0a8dcdd0f339a77ee2553dde332ed8e98fe413a3ff85a157de3f0a420d0b8236
SHA512

588fc1c431bdfeab56cc4c6d8a7230b133b2f225e1a4ebdaa9fb50c1f41f651d5e16c7373a83e9a420bc6bf4f24670062d5bcd3bd480d6dc286c0e3ef04d577a
SSDEEP

6144:Kf4w7Fj9bhkc0lZW8f2RwZkCL4Jy7n3GGueA:Kf4w7Yy8f2RwuCXD

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2736	2684	rundll32.exe	31
PID 2684 wrote to memory of 2736	2684	rundll32.exe	31
PID 2684 wrote to memory of 2736	2684	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DChat64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2684 -s 104
  2⤵
  PID:2736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads