a00efafb9deb99a99bfdd34f55818983e9cc675d1cac6b71b9fec4b0bea1aa56 | Triage

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 08:22

Sharing

Report Analysis Logs

General

Target

CoralApp.dll
Size

109KB
MD5

007807250a94f82a475c21908f840ea5
SHA1

187cba9542083eefab386b2f51610a3a9eed0fde
SHA256

f8af22dcba5f19703cf3a8bb36b14c7c8f1c4797dbc383844f78db3eacbcf4cd
SHA512

58c48e86a9635bac92569fcd5afa48508c96a833576eedd76efb010883f0e711baab18f79bfa92be71a5b85256b60bbc9ab3bb2da3243a460d37e3aee898d241
SSDEEP

3072:0fbZOmtLctOIJ2B5H4vNdvEKl19U16LS3HOgZAwXjSy:8FOmtgtOS2B54ga19U1j3HOgZ1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1728 wrote to memory of 1952	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1952	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1952	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1952	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1952	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1952	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 1952	1728	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CoralApp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CoralApp.dll,#1
2⤵
PID:1952

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...