2afb5303e191dde688c5626c3ee545e32e52f09da3b35b20f5e0d29a418432f5 | Triage

Analysis

max time kernel
49s
max time network
148s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
01-03-2023 03:03

Sharing

Report Analysis Logs

General

Target

x86/plugins/ExtendedTools.dll
Size

171KB
MD5

013dbb7c2ad8ba8b253a79c38caa5fe2
SHA1

5843281bcf9ee9bbc07179ef5032b5b7c8dcc555
SHA256

b029eb3a7444fa333daf8410dad0f770e2e9ff57a3ba6bbdd8b5d2696f43646d
SHA512

34d79a48a7d1af61f79c5f5dfa3fb5ce4f80c96ca078b343f03b57dfa8ab180a1ace9ff7501253c4a30cd2f1122f9154e2bfad8ea8b0aa31707e3ba31859e126
SSDEEP

3072:TACydNlIeMYoFoafAYDhjstr3cU/exUyND5VpCb2:TATeiNc3KU5Cb2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 2152	400	rundll32.exe	66
PID 400 wrote to memory of 2152	400	rundll32.exe	66
PID 400 wrote to memory of 2152	400	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\plugins\ExtendedTools.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\plugins\ExtendedTools.dll,#1
  2⤵
  PID:2152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads