e498b7a3b8c47519121d0f94bca46d9d4f4611a348377a1070cad78745e4f1b2 | Triage

Analysis

max time kernel
8s
max time network
14s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-10-2022 07:52

Sharing

Report Analysis Logs

General

Target

dll data/BRD.dll
Size

105KB
MD5

4d25c6ffe68dd2f767444c4a68243171
SHA1

71390b13ed224223a978853a6dc052acbd71e495
SHA256

4a3e883249c4e6514987a0b21433548f7bda8bf419b9e9896792ecd8929cb8f4
SHA512

6ab3cad97a099694d86bd5d7fcfd5ffeb94a516613b82b9d612e3df8e0e5a4fbb03f239eaec72133a63cf86b9aa3022a3ddd02365a9e65f9084614ba9e7cc79e
SSDEEP

3072:wVufqMC3mgTsiRUqYgOx0u4Ha+Oat7M/5:g9mgTsiaqYgOx0uLS7Mh

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

rundll32.exe

pid process

3052 rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1600 wrote to memory of 3052	1600	rundll32.exe	rundll32.exe
PID 1600 wrote to memory of 3052	1600	rundll32.exe	rundll32.exe
PID 1600 wrote to memory of 3052	1600	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\dll data\BRD.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1600

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\dll data\BRD.dll",#1
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3052-132-0x0000000000000000-mapping.dmp

Download