09069fcc7b6501031662c575d1034e4aac38361cca3e4f37eac1e73fb6d64c63 | Triage

Analysis

max time kernel
51s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2023, 07:27

Sharing

Report Analysis Logs

General

Target

Alphen.dll
Size

8.3MB
MD5

8742a4faf0df468b686ef1efe9c98f53
SHA1

38de542c8b68af819b80116013daed4086734a69
SHA256

09069fcc7b6501031662c575d1034e4aac38361cca3e4f37eac1e73fb6d64c63
SHA512

5fe657864f9d1219768fb9de0ef0ba0a04bd305b879c79cc7fd970f1d5c9f28138d564489d025a395880f18d5e065215e3c64f483762555099d5a664477f010f
SSDEEP

196608:VMWnfOxwBWa4tRVEMSF0Ebf8srwzCoPMSSPFOv67:pn3EXEGerYSP467

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 2936	4228	rundll32.exe	84
PID 4228 wrote to memory of 2936	4228	rundll32.exe	84
PID 4228 wrote to memory of 2936	4228	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Alphen.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Alphen.dll,#1
  2⤵
  PID:2936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads