a8e7fcd3082840075dae30a1604cffb215299f554561ba6258658d5511bb9d6d | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31/01/2025, 18:55

Sharing

Report Analysis Logs

General

Target

boost_thread-vc142-mt-x64-1_84.dll
Size

106KB
MD5

ea87719e1cc34ee053b121f0b5d908ac
SHA1

55c837476cbd2a212577358a328cb19c800881e1
SHA256

c41850abed7305faab56fb8d34551f355f3de5c4409cea1770cd4ab4414d0645
SHA512

eff7cbed1390637702ecda75c0ad80e0cc94f255464e10734963465ebe826442b2e3663aa3521dfcdbaa28c166da1132014822e4a2857542b53a531503d45823
SSDEEP

3072:ssXf59LAF17l7ISQZC6mfZ/sdypy5TkXep:sszEv79ISSGOypy9p

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2692	2660	rundll32.exe	30
PID 2660 wrote to memory of 2692	2660	rundll32.exe	30
PID 2660 wrote to memory of 2692	2660	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\boost_thread-vc142-mt-x64-1_84.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2660 -s 80
  2⤵
  PID:2692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads