bc9b8cf8152e01d5bb605de7219cb6713b0201931c53dd9a0011dfce13b030d2 | Triage

Resubmissions

21/08/2023, 16:18

230821-tr7rnafg61 7

21/08/2023, 16:16

230821-trbdfseb79 3

Analysis

max time kernel
138s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2023, 16:18

Sharing

Report Analysis Logs

General

Target

api-ms-win-core-path-l1-1-0.dll
Size

3KB
MD5

0ed28b807adb89aa37f9b3c057134f4a
SHA1

d2c4da154e9ea35f722c4d30b0dbd4dba6be4dab
SHA256

745c3aa5871af101b3b023a948fb0cc73904235085f011c9906a5804d5d71584
SHA512

78d06f92bac59432be372af8a81190b68a397c4775a262095d619644032e16ba32f10a342ffbec76e4d636606d78f766ce76dbb1664b8a01811eb2be9dbabf0c

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 1956	5056	rundll32.exe	82
PID 5056 wrote to memory of 1956	5056	rundll32.exe	82
PID 5056 wrote to memory of 1956	5056	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-core-path-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-core-path-l1-1-0.dll,#1
  2⤵
  PID:1956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads