3de508f45986acf9fd4a8ecdcd44edb95baf1246d2d1a4226baee066ba8c2869 | Triage™

Analysis

max time kernel
135s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2023, 15:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
loader/2.dll
Size 824KB
Sample230614-sw8dbaaf97
SHA256 33957d929487d6de68af0858650aedd2b021758c40815f84816ba4b6365ec143
MD5 8d3b4b382871878c29a289ad9c39e103
SHA1 def517b6271352400277a60cf640ff465431a40f
SHA512 3ffff90ad685d650a9a9b9d6a257b08a2f9b9e7c8cff4688ae0121b7155331987cb515b24096748320d60e2d1ddcab2a53b03ce5371291981010fbd9edf1fe39
SSDEEP 24576:3C4lIeA97+mgxDkID8c4aykLy6GNZDjf:37iovQatLy
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 616 wrote to memory of 536	616	rundll32.exe	82
PID 616 wrote to memory of 536	616	rundll32.exe	82
PID 616 wrote to memory of 536	616	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\loader\2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:616
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\loader\2.dll,#1
  2⤵
  PID:536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads