7a39caf04d025428d5d9e5098fef74e22f59eee2c3686f676e235ae954b18b6d | Triage

Resubmissions

10-02-2025 02:06

250210-cjg3laykgq 10

10-02-2025 02:04

250210-chg17syrby 10

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-02-2025 02:06

Sharing

Report Analysis Logs

General

Target

encoding-conversion.dll
Size

28KB
MD5

b0f21ea663476cbf02a93b8de7152586
SHA1

b6253d151a6d88ecf7029e79bbe4737792dfa79d
SHA256

249e70a3bf203692e2212ede45fdefecafaede7ab9fa6cefcf02a65f0e14cbe7
SHA512

59fcddc5b4a87efca72a9a7c1252701c57ba65c656958d9c0a5557c3ffd049fcfeb10d6ddfeca8e33171cd269c03bb19ecbb5e7e9a25e664e1b26c81211db1c1
SSDEEP

384:FibcYRa//wXJg3s4h+hh0cTGfZihL0cTGfZVhm:jCLOph+hhTwiNTwVhm

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 1856	2892	rundll32.exe	30
PID 2892 wrote to memory of 1856	2892	rundll32.exe	30
PID 2892 wrote to memory of 1856	2892	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\encoding-conversion.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2892 -s 80
  2⤵
  PID:1856

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads