2dea97fa7ef3e4930e95666fc4ee94b781a3f9e787cbebc6e7bd3fd3ab88f0bb | Triage

Analysis

max time kernel
135s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2023 09:20

Sharing

Report Analysis Logs

General

Target

PCICL32.dll
Size

3.6MB
MD5

00587238d16012152c2e951a087f2cc9
SHA1

c4e27a43075ce993ff6bb033360af386b2fc58ff
SHA256

63aa18c32af7144156e7ee2d5ba0fa4f5872a7deb56894f6f96505cbc9afe6f8
SHA512

637950a1f78d3f3d02c30a49a16e91cf3dfccc59104041876789bd7fdf9224d187209547766b91404c67319e13d1606da7cec397315495962cbf3e2ccd5f1226
SSDEEP

49152:cTXNZ+0ci2aYNT8wstdAukudJ1xTvIZamclSp+73mPu:cTXNo0cpKwstTJIkS43mm

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1804 wrote to memory of 4632	1804	rundll32.exe	rundll32.exe
PID 1804 wrote to memory of 4632	1804	rundll32.exe	rundll32.exe
PID 1804 wrote to memory of 4632	1804	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PCICL32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1804

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PCICL32.dll,#1
2⤵
PID:4632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...