ad93e037fa69cb66bd757866fd38ed0eab0db89541b4739c302aec7e797f5ec4 | Triage

Analysis

max time kernel
143s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12/02/2023, 16:50

Sharing

Report Analysis Logs

General

Target

32bit/Plugins/Mesh.dll
Size

908KB
MD5

2ae8e18ca654b4152fc6ad3fc6a9ea85
SHA1

ae84308d121c4a22b5b66962a31789f7cce43471
SHA256

56e497b6b4eec41f824456a79b312bce9ebd4bad81257f00d71763da3850ffa9
SHA512

51f838af338f031be2227650bd70c792648a6525561a37b6feb50fc781f64b97a7db430fe772c32145e93dba74b32240d747fcfff544c32d8535196aaad616f6
SSDEEP

24576:GB1Xt6AEr1w0x77LlMOUxqSQ2Oge/WRA36gT00y2:mtjK13x77RNSQ7SA3lT00

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 720	2144	rundll32.exe	81
PID 2144 wrote to memory of 720	2144	rundll32.exe	81
PID 2144 wrote to memory of 720	2144	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\32bit\Plugins\Mesh.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\32bit\Plugins\Mesh.dll,#1
  2⤵
  PID:720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads