561ac9394509138348480e01174b172865a62e459b513eaf563e56383f6245d2 | Triage

Analysis

max time kernel
306s
max time network
380s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
30-06-2024 18:26

Sharing

Report Analysis Logs

General

Target

PROPAMAT/ChilkatDotNet.dll
Size

2.3MB
MD5

627f8d5e2f13250297736da989024cf4
SHA1

d3ee2bb095a8a5587be8dc57f8a1ed0c60dcecf0
SHA256

273eefd597ebd5e8e9784245eea3a5a3af814a02319867cbf1b2967ee747c5c3
SHA512

a2aa4edfe293a0cdf9295dda65b9ff029f2f0b0b63956e7f68c60830ba3ea8589012173948095b3c9018c461f7d9c7a2b1250e8eb1c68a7560353d1325daa79f
SSDEEP

49152:fFgYhJKQbpx65rMSTOtMbrWrfhQ49pRb:fCYaQbvY4Q6fx

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3296 wrote to memory of 1660	3296	rundll32.exe	rundll32.exe
PID 3296 wrote to memory of 1660	3296	rundll32.exe	rundll32.exe
PID 3296 wrote to memory of 1660	3296	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PROPAMAT\ChilkatDotNet.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3296

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PROPAMAT\ChilkatDotNet.dll,#1
2⤵
PID:1660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1660-0-0x00000000731B1000-0x00000000731B2000-memory.dmp

Filesize
4KB

Download
memory/1660-3-0x00000000731B0000-0x0000000073760000-memory.dmp

Filesize
5.7MB

Download
memory/1660-4-0x00000000731B0000-0x0000000073760000-memory.dmp

Filesize
5.7MB

Download
memory/1660-6-0x00000000731B0000-0x0000000073760000-memory.dmp

Filesize
5.7MB

Download