49febd721b50c554167b59bc876a1a261896822096e39357e67cf9ef9dbaaae4 | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13-06-2024 07:02

Sharing

Report Analysis Logs

General

Target

udis.dll
Size

129KB
MD5

88e01cf86d15be0df1209c5f0f76e4f5
SHA1

6f0a0e19acdf66764c5fd0a03c1787a982746c6c
SHA256

4f21456111057cfae3147c674573a3f72edc2ab22d1ea2b1b07611bfe9678eca
SHA512

6c1a3a9255b681a877ccc1fb088bce77437c40cfd5e4592064dd7b9a8554630b2beb6affcd2f9681889e013d27c9219f10139fe86e5678968236baa4482ff4c6
SSDEEP

1536:3oytRJNwZ2wcUH8jeo46JH5ujVrWpPwMmOZoqqPu23ipyqb1EE4:YyM6UcjznCWKOZo/Pu2iN1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2180 wrote to memory of 2384	2180	rundll32.exe	rundll32.exe
PID 2180 wrote to memory of 2384	2180	rundll32.exe	rundll32.exe
PID 2180 wrote to memory of 2384	2180	rundll32.exe	rundll32.exe
PID 2180 wrote to memory of 2384	2180	rundll32.exe	rundll32.exe
PID 2180 wrote to memory of 2384	2180	rundll32.exe	rundll32.exe
PID 2180 wrote to memory of 2384	2180	rundll32.exe	rundll32.exe
PID 2180 wrote to memory of 2384	2180	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\udis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\udis.dll,#1
2⤵
PID:2384

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...