6c611841f8150bff3266e0421a14b57c28c8767974adbd7e056db54162184934 | Triage

Analysis

max time kernel
122s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
31-08-2023 20:47

Sharing

Report Analysis Logs

General

Target

tpkcom.dll
Size

124KB
MD5

b5552cd1a82017b7ba485fdec07b5c59
SHA1

02e6a4bfa68852b9f25c3b6e57724436b1bccb82
SHA256

a7c996fcf8c1ba6cce06be0c73fb9c90931312206bb121ed43ba92964ba7e558
SHA512

a6d966175d5cfba64c76c51f146492224393256abdf19847f5c53746c597e73ae8d58e2ff959d9994462077d04ec6c4eaebbdef527ccd3a04bba139baf6e5692
SSDEEP

3072:29QnZ1fQCRheIJ3PTN+aRmJKy41JrVwKMOtx4:q0ZSQ3PPJrzp4

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 492 wrote to memory of 4080	492	rundll32.exe	80
PID 492 wrote to memory of 4080	492	rundll32.exe	80
PID 492 wrote to memory of 4080	492	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\tpkcom.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\tpkcom.dll,#1
  2⤵
  PID:4080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads