6769f3dcde3cc9f6fb8fd1fb6a37b52221ef79b97d5d4002c44308da7a24b144 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 13:11

Sharing

Report Analysis Logs

General

Target

Nursultan Alpha/freetype.dll
Size

536KB
MD5

ff1ce3471c79a306059fddca3a853a00
SHA1

b7f1e72a2cbfb8d3217f7a5c2b6ad374c6b1e3e2
SHA256

951181210d554b4db1b638345eb30457ad11c8b625b283b0df86f67141ae3059
SHA512

d5d6e187888f676d3582440d86e1e3d7ca5ef79d4cecbe1263702646c96c5691c43553002457cc8921e1fd8987717663c58601adf4e5ae80909988198d7fc34c
SSDEEP

12288:KhADVG7gNFjnG43BGCGl3cgrifEWm35sbBxuD:KhQGWi43BGDPZ35ME

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2308	2392	rundll32.exe	31
PID 2392 wrote to memory of 2308	2392	rundll32.exe	31
PID 2392 wrote to memory of 2308	2392	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Nursultan Alpha\freetype.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2392 -s 80
  2⤵
  PID:2308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads