1c95e2de3bca3fea01374b156e547a840d0adf592d7ef17155c54fcbc6d69841 | Triage

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 09:09

Sharing

Report Analysis Logs

General

Target

SFhelper.dll
Size

60KB
MD5

a2f3195a34dfb07900fc784a32a37d3f
SHA1

7e60c4ec6e1aece0de663f5ca614d22a77cc680b
SHA256

c0234f29167c2d0b6284dd3a32a0a6c1ab9bbd2f2475ccf5c3e758d4070835ea
SHA512

3aaaebdad04878af5a9692308b1ee7f91dd6682f9b046a23e803001bb6df5b87550a06c1c3b4be93169a582935859e3af0fce2947e01d56ead3bb204a9458c55
SSDEEP

1536:6QkiaCePX+reI3QkQpWhuVXSigCWgOQgrfqC:6QkiDePiP3mpWwVXSigKONL

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1252 wrote to memory of 2000	1252	rundll32.exe	rundll32.exe
PID 1252 wrote to memory of 2000	1252	rundll32.exe	rundll32.exe
PID 1252 wrote to memory of 2000	1252	rundll32.exe	rundll32.exe
PID 1252 wrote to memory of 2000	1252	rundll32.exe	rundll32.exe
PID 1252 wrote to memory of 2000	1252	rundll32.exe	rundll32.exe
PID 1252 wrote to memory of 2000	1252	rundll32.exe	rundll32.exe
PID 1252 wrote to memory of 2000	1252	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SFhelper.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1252

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SFhelper.dll,#1
2⤵
PID:2000

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...