f97e7763f53610fb7915fa5ee7d0fd649749281f6ea3c6774d044c641cc32a86 | Triage

Analysis

max time kernel
15s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 08:34

Sharing

Report Analysis Logs

General

Target

Lib.Platform.Windows.Native.dll
Size

503KB
MD5

232371076a23379753eb776cf06fbe5d
SHA1

6a5ea5d44e555ad392725e5ac3d80af0137386e9
SHA256

5940f9d18b9439ecbfcd6edc60563d6f56623d03f09eafa786c436185ef156bb
SHA512

590f67e8455dcfe57795f17c94e6082b54c1feaef81942b1e92efc7905e3e6b6ec7a05eef12a8f0483b5dc1928dc9e7645a74bae31e77f7ac403c64344f09625
SSDEEP

12288:hY/Hjc0/Lf7vjm4GjDL7ROBM1SMzRJTp4g4D:hY/Dc+LDLmVL7QMx9Np4g4D

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2644	2376	rundll32.exe	29
PID 2376 wrote to memory of 2644	2376	rundll32.exe	29
PID 2376 wrote to memory of 2644	2376	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Lib.Platform.Windows.Native.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2376 -s 200
  2⤵
  PID:2644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads