9733e3f15efe06bfbf6f1e890eee2f4b550f053acb18be931b1cb1c0c8f004ab | Triage

Analysis

max time kernel
141s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
31-08-2023 02:57

Sharing

Report Analysis Logs

General

Target

todolist_exe/FMindImportExport.dll
Size

120KB
MD5

a36c0bd65dff47d30294f1d7b350f62e
SHA1

2ed1cbaf4601c270695ac0bde3e07a72ada7b6da
SHA256

cc8845dc605e06f999e8ea3be16e3fba7bedfd2f2c3246e9fdc25701b48a0d74
SHA512

109e16377ef1b036f40f13125998dc5fbabe0cc36a5fd85c375de24df2c1181dfa3b9a19ab21894607b244b3ae2cc055b93db3b89283258059e93543a919d9b9
SSDEEP

1536:T9xt8P3UH7LwiBc01pfJ4MfQ2vAQF8hHfhA:1zc0vQ2vRFEfhA

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 4524	4416	rundll32.exe	81
PID 4416 wrote to memory of 4524	4416	rundll32.exe	81
PID 4416 wrote to memory of 4524	4416	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\todolist_exe\FMindImportExport.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\todolist_exe\FMindImportExport.dll,#1
  2⤵
  PID:4524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads