cddc7c774570b556d8d391203f8084e97850f3cee8a482a0c36ea74de348da2f | Triage

Analysis

max time kernel
124s
max time network
132s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
23-07-2023 22:52

Sharing

Report Analysis Logs

General

Target

languages/en_XM/DeviceDiscoveryModel.dll
Size

37KB
MD5

9740e8029ba6e212993a7f7c655af9c9
SHA1

08f80bda7766876434d82d3b1f43f4246ec089b1
SHA256

8a59aeb5f27aa2957f0d3dce27bab7632d199a6ce6b59b87bc8f9852f240aaa0
SHA512

76d62ca1171c051d3425c53f2712d469072eb69bac4e0f21374ae9cdeb7bd1f28132f814e2600dffa0763854c48c74fcfbac80ffe10c2c681e4898812bb307e0
SSDEEP

768:7J0nhnBTCt7IGo3j3qx1z4+R5BIWfo5IvU9:4VCtUGS3Gs+RUTGU

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 4868	968	rundll32.exe	70
PID 968 wrote to memory of 4868	968	rundll32.exe	70
PID 968 wrote to memory of 4868	968	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\languages\en_XM\DeviceDiscoveryModel.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\languages\en_XM\DeviceDiscoveryModel.dll,#1
  2⤵
  PID:4868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads