8e86e10a9b3a48604514c4fab81a68afcc48d1cbcf932255afdc8ca85e33c12d | Triage

Analysis

max time kernel
227s
max time network
296s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
17-05-2023 04:26

Sharing

Report Analysis Logs

General

Target

PvZRT_Data/Get.dll
Size

340KB
MD5

c61fd0d847df328fd6f0a98e4f030f41
SHA1

c3d8c3493818c44723e1466b411a3b5e188d823f
SHA256

791e717345991c4bf183c6450667498a89b59c4e8a5abb52e2751fde63d3ad43
SHA512

72cb1345af5834cbc89c9244c935cd62ea7a9d19d34a39eb6d69c32bd10302c1c0a9c0573278e6424bee1f0a771ea46e7fb907c630742dcfc6bbb572b393970e
SSDEEP

6144:v1xzFQHtjxSA8gGMtobtDaq7eYzQzsgXsJ9XWLrpV0k:v15FQNx8gGM6tuq7eA0sgg9XWsk

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 996	2572	rundll32.exe	63
PID 2572 wrote to memory of 996	2572	rundll32.exe	63
PID 2572 wrote to memory of 996	2572	rundll32.exe	63

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZRT_Data\Get.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZRT_Data\Get.dll,#1
  2⤵
  PID:996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads