91bf580d7d1bc2ee8e9aecd67be0cbc3cdad83a0ce1b44291ab9f2e9c34cf1a6 | Triage

Analysis

max time kernel
16s
max time network
18s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 12:47

Sharing

Report Analysis Logs

General

Target

dbdata.dll
Size

106KB
MD5

2d337c78ad014b4d7e43fc465f757a7b
SHA1

258ee30b7dedd2924203d329aac818b509396440
SHA256

465059d2eeeeffd4704e6143c2184d8a5eb09ebcaa7cdb31e6c93467bc025124
SHA512

e1928305c8df1618bf3f2e818cee411859da46c6c31fbc552ac07ebf6cf0d58681e929d2a0bf9fed381bc601ec664c96b46af787d95923e5bff8120c2c35f383
SSDEEP

1536:5gIbpZKhJLfcPQ3gJ2h59C9nzZ/k1zeFu:LpKLf13ffpeFu

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 2324	1040	rundll32.exe	29
PID 1040 wrote to memory of 2324	1040	rundll32.exe	29
PID 1040 wrote to memory of 2324	1040	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dbdata.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1040 -s 80
  2⤵
  PID:2324

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1040-0-0x000007FEFB840000-0x000007FEFB861000-memory.dmp

Filesize
132KB

Download