194d2bcf5594e4d2d9cbd85e619209b08ba219776edaa9a3f39e3436e9172934 | Triage

Analysis

max time kernel
139s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
09-08-2023 05:22

Sharing

Report Analysis Logs

General

Target

lzo.dll
Size

87KB
MD5

f0d3f2b94cd599201c5cb6ae4bd0143a
SHA1

72af5cb900397171da08ce9c3aa90d3ca95cee66
SHA256

e0b5a7bccc75564052e79cf2e35cb2bfa2d5a3435c44ed5bf7efbb7baf770874
SHA512

13fe68fbd193fe32e65019e3e862980db489c64c8aae8b2220465636d0d91b1c7c3847f1dd771113b2238a0dbe2e7bcf75797f8751c84fc1fc9d93793693e8c7
SSDEEP

1536:z2kD1qx8Jw/IO2nVncK2HTQOnGVZnzba43QtkdNqo:z232JO2n+K5OnGFQtkrqo

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2072 wrote to memory of 1988	2072	rundll32.exe	81
PID 2072 wrote to memory of 1988	2072	rundll32.exe	81
PID 2072 wrote to memory of 1988	2072	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lzo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\lzo.dll,#1
  2⤵
  PID:1988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads