9c8f9348a7104a6477335a4115c0a1fcb881540c3b66b3cc13991f38bd73a70c | Triage

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
01/03/2025, 22:31

Sharing

Report Analysis Logs

General

Target

NovalUPDATED/Noval/bin/libvpl.dll
Size

502KB
MD5

0a678cefdfccb717a9745f9294a61109
SHA1

0c25235ae23faf11e9a7855afe0628c8499ca500
SHA256

3b8ceb7c978665b75ee6ddf3bc7efbd8e9ff03edcab44dfa92f3b667586c36c6
SHA512

c446a9e10cddbce4cf5181ba56b412ae96beb3ece5ad29298f05a54ab8fd0f21a8ad1c586f4f2150d9b899da73981da748e4bc9ec0bdc820e3ff5730b068729f
SSDEEP

6144:XTNdC09UJs/NxfjxY4MyZyVThwbjR2qdASddRhBhoM:Us/NxdY4yaboGdzP6M

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2732	2076	rundll32.exe	28
PID 2076 wrote to memory of 2732	2076	rundll32.exe	28
PID 2076 wrote to memory of 2732	2076	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NovalUPDATED\Noval\bin\libvpl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2076 -s 120
  2⤵
  PID:2732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads