18f7857e3bb5f9f830917c9073d3c339bf7b3e14fcd3edfdca976287f41536c6 | Triage

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 19:10

Sharing

Report Analysis Logs

General

Target

m32/pthreadGC2.dll
Size

92KB
MD5

ac05fbba61f939cd90133032f2595c69
SHA1

ce3d3811457176dbefb06f5a395505eef8b2a641
SHA256

c271f42da9f1483de15869914d216a8ef44ca80c0d5907789b6e9873e3aa245f
SHA512

86992775393bf03a13058246c780cb20ea505f6bfdc3baec57574bae076369ef0d2c154bb14fcac947e96e11a93baa3d88b4b49d3fdedd2da2a5c36caab85288
SSDEEP

1536:oeHa2+yL/iA1P91IBfiH/p/DKIMds0RweKZw:oe6oLiA1rIBfiH/p/DKIMds0Rwel

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2340 wrote to memory of 1368	2340	rundll32.exe	rundll32.exe
PID 2340 wrote to memory of 1368	2340	rundll32.exe	rundll32.exe
PID 2340 wrote to memory of 1368	2340	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\m32\pthreadGC2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2340

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\m32\pthreadGC2.dll,#1
2⤵
PID:1368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1368-132-0x0000000000000000-mapping.dmp

Download