194d2bcf5594e4d2d9cbd85e619209b08ba219776edaa9a3f39e3436e9172934 | Triage

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
09-08-2023 05:22

Sharing

Report Analysis Logs

General

Target

msvcp80.dll
Size

536KB
MD5

38e1a82ea77e591245fd7487a7e32fe8
SHA1

920a0c5a8c5afc3ba22a5a208ff8acba25a641d4
SHA256

4abb7b40d139d4e25a3c6150a48f935508d22a71cdf6c50029185fcdd79e3671
SHA512

dd337162421540eccb25149d65d2fd52db2a232a52e6b0b35925a3dd48dcac6bb9dc373e41a2cb4ed5fd1f0f337c25579fc5be431dc81ea112930db8e37bef64
SSDEEP

12288:HZY4lOHMwLwXBt+ia21tsUa/hUgiW6QR7t5j3Ooc8NHkC2e2:HZY4lOHMM8wib1tAj3Ooc8NHkC2e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 4492 wrote to memory of 4716	4492	rundll32.exe	81
PID 4492 wrote to memory of 4716	4492	rundll32.exe	81
PID 4492 wrote to memory of 4716	4492	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcp80.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\msvcp80.dll,#1
  2⤵
  PID:4716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads