5642d1ae53a6dba7a084d997ca76305e40b897e90b1f7a932e08d980ea1a2ba0 | Triage

Analysis

max time kernel
84s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
25/04/2023, 14:05

Sharing

Report Analysis Logs

General

Target

portable/wx._misc_.dll
Size

716KB
MD5

1e4649cb160a03697ae1e61b0b6cd981
SHA1

2e5152cbc7460ab55da7c2538e8d18d203bf2c0e
SHA256

abdfc5cdb1ef9b634162c415fc03b1d4cf715341939a43c30ead2ba26602a96d
SHA512

be6702db41712987a60a6fa1146dd8078c00cb4a2dc81c72989851b5705ec938fcc9b016d79556eb6851d7b539b436b5fefff1bfce9484e4d7634c95852149bc
SSDEEP

12288:Jah2oAI8lR/6X5lVetx5A3tQdZIL3RtFihI0Q3DMLJI:o2oAI8l0J5AWyQ3g9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 3748	1348	rundll32.exe	83
PID 1348 wrote to memory of 3748	1348	rundll32.exe	83
PID 1348 wrote to memory of 3748	1348	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\portable\wx._misc_.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\portable\wx._misc_.dll,#1
  2⤵
  PID:3748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads