6769f3dcde3cc9f6fb8fd1fb6a37b52221ef79b97d5d4002c44308da7a24b144 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 13:11

Sharing

Report Analysis Logs

General

Target

Nursultan Alpha/j2gss.dll
Size

49KB
MD5

3e06f0d75815a429e77cfa42519dff51
SHA1

46101f04e49cea2f9ca513a14d6e1907dd7746ed
SHA256

943f9a48599b46db5ddc9337107844e22e8228f221807c2b606f30b7c3d6329a
SHA512

39a6886ba6f851658e68fa83d7f97d6ca991332ae4c8a4b0bbfa0f62e892ed7aa8d1868741310757b333f1178084c1c1eb3d065e428a2f7da3c18f3afa44062a
SSDEEP

1536:FSx2TnHUwCK3CEgCG+YDU1MK27xb74zx9m:B0e27xbUm

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2664	1964	rundll32.exe	30
PID 1964 wrote to memory of 2664	1964	rundll32.exe	30
PID 1964 wrote to memory of 2664	1964	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Nursultan Alpha\j2gss.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1964 -s 80
  2⤵
  PID:2664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads