a8935e5869acd6cd9a39ccf886f66fe3c278dfa0e4f71f8faee596fe4b69b028 | Triage

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2023, 17:40

Sharing

Report Analysis Logs

General

Target

ZMenuMW.dll
Size

4.1MB
MD5

d27388c8427fc5b346a49a1d05b2b0c2
SHA1

e34bc9fc88bf94eec10ee76a616af432db4eb888
SHA256

600952bc882d0b58b47936b33a8cbeb0a030f58e632540fbd8c16cc6b00bcd34
SHA512

b461c3808f4c14e7805d79d300c077f5314078ade97c700366665fb29a5309c868b924344551df04e8049c9f78ea33f693551d715c4eff7c02436555d09597d5
SSDEEP

98304:mflUbMlck23yBN+h+efEEN+F192HvTPSSNAk2jH6rs+NcadZ0bM9f04xSnqbzA91:m9UbMlcZzj2ip4T

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 4648	4276	rundll32.exe	84
PID 4276 wrote to memory of 4648	4276	rundll32.exe	84
PID 4276 wrote to memory of 4648	4276	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZMenuMW.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZMenuMW.dll,#1
  2⤵
  PID:4648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads