6a0664da0332aa8f4428914ba6aff37506fd239776a881e6d24f1cf5b60cbb70 | Triage

Resubmissions

24-09-2023 15:33

230924-szdm4shh59 3

Analysis

max time kernel
133s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
24-09-2023 15:33

Sharing

Report Analysis Logs

General

Target

libcobra.dll
Size

426KB
MD5

c45a0141c517dd1d481f08bb76333a05
SHA1

a18255bccee6c98ef6c6d41e93567e4f20c135ef
SHA256

f2a1ff120e261e2bc66e5d1f0b74bad865cfc158aae24f35c94bee598e226890
SHA512

de7f233ca66cb24c0a9c5690331acfc0f7c1b13a9b411d57fa3ce2f9b4eeeb7733f1eef6890ff9895e95e7d9a560c060be54652e4fddcaf282f016ae6a40f805
SSDEEP

12288:bCBmOIZTP1NNimsq48UFhsP/YVmfeWq55WSFHD:tLTPchggVmfeWq55bFj

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2248 wrote to memory of 3108	2248	rundll32.exe	rundll32.exe
PID 2248 wrote to memory of 3108	2248	rundll32.exe	rundll32.exe
PID 2248 wrote to memory of 3108	2248	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libcobra.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2248

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libcobra.dll,#1
2⤵
PID:3108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads