a11f58835e0bc2bca60c3532dc0bd3468f1cbe2d688cbb6027ffa6931cedb41f | Triage

Analysis

max time kernel
172s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2023 13:57

Sharing

Report Analysis Logs

General

Target

JcmRts.dll
Size

89KB
MD5

a50a3949f61015cd963efd9595333253
SHA1

bee158b92e9876adebd93e85de8a292009c4c2e5
SHA256

ba04051a269bb165685d08167c24dfd650af8efc38da98ae4f27d828c25de2da
SHA512

f3559b5f35d7f337314117cb7f642c5d6e37b87f97ee7609eabe81081e745fe02d3cfd97889c88ce49014e3561fac84872c97e92b13dd69f1dba64fc32590c3a
SSDEEP

1536:CE3h7euorR99U9J21E8VuaDoQI93sW2cdSN+ItwGscaGCwBO07CRqicPw:cVbU9oaNNl9hSN5twGscaGoMCR

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3340 wrote to memory of 4276	3340	rundll32.exe	88
PID 3340 wrote to memory of 4276	3340	rundll32.exe	88
PID 3340 wrote to memory of 4276	3340	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JcmRts.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JcmRts.dll,#1
  2⤵
  PID:4276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads