4c048169e303dc3438e53e5abdec31b45b5184f05dc6d1bc39e18caa0e4a3f3e | Triage

Analysis

max time kernel
13s
max time network
18s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
27/03/2025, 15:30

Sharing

Report Analysis Logs

General

Target

libssp-0.dll
Size

15KB
MD5

d37b46aaa0276d199d13ddbc06b53fb6
SHA1

5b37e302e826488bca5f29a1fe6c9d3e3037979e
SHA256

e1b206a63410bdb6d91a7a61941e7329b3309d93d43b4a1d35df890713c0a1f1
SHA512

819a5cd39f61f2de2203029fc2788612a2355b85c7f9f499a9e72cb4ef5c182610d72e8a0a592eac9e006853e5fd993ea471d5d1f2be5af9ea5367e3e2d8f7b0
SSDEEP

192:sYRdUKvxkxqf6JAHTRhrrgDdVnwqKfIPf+91wjQtOqH7UaG8xBtq:lRdfEOpzRhr0frckf+PhtOqbBxBtq

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 3016	2540	rundll32.exe	29
PID 2540 wrote to memory of 3016	2540	rundll32.exe	29
PID 2540 wrote to memory of 3016	2540	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libssp-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2540 -s 96
  2⤵
  PID:3016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2540-0-0x000007FEFBE30000-0x000007FEFBE3D000-memory.dmp

Filesize
52KB

Download