8e86e10a9b3a48604514c4fab81a68afcc48d1cbcf932255afdc8ca85e33c12d | Triage

Analysis

max time kernel
287s
max time network
296s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2023, 04:26

Sharing

Report Analysis Logs

General

Target

PvZRT_Data/KcBoxA.dll
Size

44KB
MD5

08ac00f4d05e68d8b5ab6870bf1f076e
SHA1

b8eb503bf860df5938df5cd59cea47392d129217
SHA256

1cae93696ec030be6317a338c3c8bc4274a53632c03ca60aab0bee59d361a380
SHA512

1da050749fb1e8f2917e550a86933b9f69cf4e972f1a166d0c24a2c9e1307fbad88aad36e7f1082d481c116f36e8e2b3327d630c136f02f6f465835fbd76db2e
SSDEEP

768:6QAMQ9VKxyrwDjJCPru5g193lY5/LoNqN/qCD:Pl4KxZuq5gso8NL

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 5076	400	rundll32.exe	85
PID 400 wrote to memory of 5076	400	rundll32.exe	85
PID 400 wrote to memory of 5076	400	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZRT_Data\KcBoxA.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PvZRT_Data\KcBoxA.dll,#1
  2⤵
  PID:5076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads