2afb5303e191dde688c5626c3ee545e32e52f09da3b35b20f5e0d29a418432f5 | Triage

Analysis

max time kernel
143s
max time network
147s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
01-03-2023 03:03

Sharing

Report Analysis Logs

General

Target

x86/plugins/ToolStatus.dll
Size

223KB
MD5

837ef2b8f202ab9f53545fa2bc7fe71e
SHA1

4fb675056cdcf97a6fde847bcdb7d8d591771387
SHA256

a4ef4fa8a094983ca9a532dad9866e27d0211db98a5def3a3c4eb73f6d92d233
SHA512

d39b000d6d31bef3cf053443f3576318198e2b6ed180a0e4344dfb44c0d5549f09192455a4a2c55860c34723f50ac1dda23264259083a7b182fdc1a6d366a481
SSDEEP

3072:C8faMRFQENjlUcykpTRem9Z4wZOeb299zBwJY3G5:C8fFQEzUE9Ceb21wJY3G5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 4268	4192	rundll32.exe	66
PID 4192 wrote to memory of 4268	4192	rundll32.exe	66
PID 4192 wrote to memory of 4268	4192	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\plugins\ToolStatus.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\plugins\ToolStatus.dll,#1
  2⤵
  PID:4268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads