94b12e976502462ed5d7b0ebd9d55adfaa40e2f42dd89d9dee8b272e5e079a4a | Triage

Analysis

max time kernel
139s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2023 01:03

Sharing

Report Analysis Logs

General

Target

pandora_desync.dll
Size

7.6MB
MD5

f8054c24a253ed407157b22db20c835f
SHA1

4f3f9d9c78f3752a1ae8bc76a9b53e4dc7940128
SHA256

94b12e976502462ed5d7b0ebd9d55adfaa40e2f42dd89d9dee8b272e5e079a4a
SHA512

bb7e6f011f04e28aa35c1b00007e63a85acdc5efc5b7fef129885fd8c7ef3b98f5e267912dda68d7e994433caab41acb6666ac227aed56109dacd92b0afcac2a
SSDEEP

196608:NBoORoP7zPI/a9oLTW2C3s5WqYMT04usJxdesEOW:vVCA/a9QTW2C+ZykjdesG

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 1660	1920	rundll32.exe	83
PID 1920 wrote to memory of 1660	1920	rundll32.exe	83
PID 1920 wrote to memory of 1660	1920	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\pandora_desync.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\pandora_desync.dll,#1
  2⤵
  PID:1660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads