a00efafb9deb99a99bfdd34f55818983e9cc675d1cac6b71b9fec4b0bea1aa56 | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 08:22

Sharing

Report Analysis Logs

General

Target

CoralUI.dll
Size

1.4MB
MD5

2c157ecdaf8a1cec3106f214db9dd974
SHA1

a0505c990694c03b349fbc7597935807c0bfcf52
SHA256

6662595d4183df68a822c715ed3ea07e0db1c7478b76747ecfc737fc183b0aa4
SHA512

f52c4419d64426aa6a914a46a2885b77a488d2442e4b34109d569222c187a9a42872745eb0603221791cc4aae119bdfcf0776d597a5f08aebccbd051462c773a
SSDEEP

24576:olq4VOZD8+hakWpXo9AadfnzcSknBC9BE8xHRwjZPMaNdrsnIy8R:zEy8+hak9a691oOedrsIy8R

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2948 wrote to memory of 2992	2948	rundll32.exe	rundll32.exe
PID 2948 wrote to memory of 2992	2948	rundll32.exe	rundll32.exe
PID 2948 wrote to memory of 2992	2948	rundll32.exe	rundll32.exe
PID 2948 wrote to memory of 2992	2948	rundll32.exe	rundll32.exe
PID 2948 wrote to memory of 2992	2948	rundll32.exe	rundll32.exe
PID 2948 wrote to memory of 2992	2948	rundll32.exe	rundll32.exe
PID 2948 wrote to memory of 2992	2948	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CoralUI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2948

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CoralUI.dll,#1
2⤵
PID:2992

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...