fe58493f156a33a70e4bb6e1806f4d52ab687d8fe07ba688acaa18f75dcd16e2 | Triage

Analysis

max time kernel
7s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2023, 12:08

Sharing

Report Analysis Logs

General

Target

CLRHost.Interop32.dll
Size

134KB
MD5

9cf158e5b1c5e16a26a1c1f356954d82
SHA1

bec3268a33fb030545fd8280844e3e6ddfd7bcf9
SHA256

e0d93184a403abe3d389d85e2e32cecff8a65b7aeb2cd07959932ea8005b3aa5
SHA512

c333848cfe7840f985f328f37456a86813f6d6cfdbaea60f6a67603eb81b72e7338cdbcce824cd35f3dee3b12914f51ffbb9841538883734424d5fd9dc3b987f
SSDEEP

3072:2bm0g6XBT5i+NQ163MTRbkrgxtBMMy7gBRz6QFOBOYR8q2:Ag2T5i+NQ17bkrWy7gLFOaq2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3724 wrote to memory of 948	3724	rundll32.exe	79
PID 3724 wrote to memory of 948	3724	rundll32.exe	79
PID 3724 wrote to memory of 948	3724	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CLRHost.Interop32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CLRHost.Interop32.dll,#1
  2⤵
  PID:948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads