6c611841f8150bff3266e0421a14b57c28c8767974adbd7e056db54162184934 | Triage

Analysis

max time kernel
142s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
31-08-2023 20:47

Sharing

Report Analysis Logs

General

Target

tpktt.dll
Size

9.8MB
MD5

14c02f2c7fb7e8d066300f692eadb253
SHA1

61b61705b383c47af98a3e0b4a7e19b1f58504f9
SHA256

06f9c495e597dc08110a1711be70e01ae7f8c07832f4df7cb0d51b49d6fa2fda
SHA512

8d3c4c4e4c00446a5af8b52457634ac4db60ff88d9a1b8679042bf35393d908002299d6f1a081d1d3d70ac4e46be5eca71999cc38525de41bed2277f2b4bd6f7
SSDEEP

196608:uAeng1/2wW3JefN2Amec9dSqBzfgxq+y6KN2t59/2:DtEefN2Amec9d35gxq+RR2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 4944	4264	rundll32.exe	82
PID 4264 wrote to memory of 4944	4264	rundll32.exe	82
PID 4264 wrote to memory of 4944	4264	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\tpktt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\tpktt.dll,#1
  2⤵
  PID:4944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads