1c388a8bd8a2f14fb270c3bcd6ef475f7536f1dd6412f0e91746c054d15db58d | Triage

Analysis

max time kernel
152s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 21:55

Sharing

Report Analysis Logs

General

Target

Ծע/ethreadnew.dll
Size

48KB
MD5

b63c5fe0ecc37dc8875e6f5a005eaf0b
SHA1

1611a5105b3f0d86ee633e1deb1beb85d451e4ca
SHA256

4c48c0c3941b1851e69773170dafa56099a8d8c1d55164d465dc50867a62a258
SHA512

7bba7504fde51bc2e34b7676bd313d2e9486f1f1f5b48b4ad7fb4a84109d7dd1f6938b1b107cb7f058287c44254cb0c52291f4de81caa1ef378d8f9433a5d4e4
SSDEEP

768:adPnk2MB8FjWl9uTSyVmKRGK6TmPsLX3fwURhFvljyX9:adZMB8FjYuTrVtq7XPnRPl

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 4100	4072	rundll32.exe	81
PID 4072 wrote to memory of 4100	4072	rundll32.exe	81
PID 4072 wrote to memory of 4100	4072	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Ծע\ethreadnew.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Ծע\ethreadnew.dll,#1
  2⤵
  PID:4100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads