2afb5303e191dde688c5626c3ee545e32e52f09da3b35b20f5e0d29a418432f5 | Triage

Analysis

max time kernel
50s
max time network
70s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
01-03-2023 03:03

Sharing

Report Analysis Logs

General

Target

x86/plugins/UserNotes.dll
Size

96KB
MD5

7de6aa4f0d79e4b243a66b4db6f17fe9
SHA1

0137fd9f2e0115e88003b80942b137ad83b52f5b
SHA256

a94d02d9645a4f4fe0388bb40775862aa3f90d22a93fdb14870389ab891b486d
SHA512

1fa4216fcf84663c185a2b244055d93b25a3242d79699a7973dc0ea50b80c4cd21df52cc6601868c9d68591d667130f4b2408093ea93641a14a352e8788d1bee
SSDEEP

3072:mEuN4hL6EK8WvWCR3RPPp9KjqzUJEAElDBUh3:9L88Wz3zYKKh3

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 1360	4956	rundll32.exe	66
PID 4956 wrote to memory of 1360	4956	rundll32.exe	66
PID 4956 wrote to memory of 1360	4956	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\plugins\UserNotes.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\plugins\UserNotes.dll,#1
  2⤵
  PID:1360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads