996e3107598f3590dc1865d564741732da01af4c012c9542e7fdcac94df4a601 | Triage

Analysis

max time kernel
129s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
24/03/2023, 17:29

Sharing

Report Analysis Logs

General

Target

PlatformResource.dll
Size

556KB
MD5

df5c8d368d2b0845763656c188b1a11f
SHA1

c9e0437c317d23b5cf770c54c9d2f619d58759e1
SHA256

996e3107598f3590dc1865d564741732da01af4c012c9542e7fdcac94df4a601
SHA512

82f958efe708b2610075b2dc40260f9c3818b491cc5673f9bb4408a93721e8f96477d4a40207c211b156308398c8719fe5d69d987a061b958cf04a6821db53eb
SSDEEP

12288:kYYqjq9pD5FU3YAZQiARbzw6U+mNtxiRoJrITVMfoZ:xFqLDj9Q6siRoJrAZ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 1784	2596	rundll32.exe	85
PID 2596 wrote to memory of 1784	2596	rundll32.exe	85
PID 2596 wrote to memory of 1784	2596	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PlatformResource.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PlatformResource.dll,#1
  2⤵
  PID:1784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads