a8e7fcd3082840075dae30a1604cffb215299f554561ba6258658d5511bb9d6d | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31/01/2025, 18:55

Sharing

Report Analysis Logs

General

Target

boost_json-vc142-mt-x64-1_84.dll
Size

305KB
MD5

ca6ee0f5b275b58a62cb7f3316e46dae
SHA1

9bd57bd3a9396db5eadc3cbd5b5feecc7dae87ac
SHA256

2eab87ef1fc0efb0af7632754a4b7304839bdf122aabafa404cc2be264833980
SHA512

c4ef4f9dbe90575d84a34b0c2a32e7855826a56add2664d57b903c5037318acbd03047c2a57be99441c92bef64e94c01b10c16c99c0583575c81da79bc3cdaec
SSDEEP

6144:97yEEpesL8KQZ1uiInDgeL7x9MTphRcqrl7/bR:FyEEQsL/hpr+phXrlXR

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2988	2904	rundll32.exe	30
PID 2904 wrote to memory of 2988	2904	rundll32.exe	30
PID 2904 wrote to memory of 2988	2904	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\boost_json-vc142-mt-x64-1_84.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2904 -s 80
  2⤵
  PID:2988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads