5f7d2e199b92158b5e54fc23cb25f489d64ba2770fe0709e522a5d0109425018 | Triage

Analysis

max time kernel
224s
max time network
357s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2023 14:39

Sharing

Report Analysis Logs

General

Target

mmtest/WinRing0.dll
Size

64KB
MD5

6fc52a8c0cccd5f9b1cdb3de99cb3d3c
SHA1

f15af33a43d6af621159ec0d74a7a7b09cb28a73
SHA256

2a2a466fbe05c6293c442429bad45b223f5742eb0ae254204bdfbaeee24c84d8
SHA512

8b56ffec3d1e7455f09a09c441c002018649310d107080fb8cc3f74d67c893712e1edbc01c14f9a53d230994e499a2434d43449e888493e0daa858359ee1b2ed
SSDEEP

768:gRP1qwVjsRDoomqfLYowvIay/scqQOTtCPzVMei:UP1Q0oQway/Cntezk

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 3132	4472	rundll32.exe	53
PID 4472 wrote to memory of 3132	4472	rundll32.exe	53
PID 4472 wrote to memory of 3132	4472	rundll32.exe	53

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mmtest\WinRing0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\mmtest\WinRing0.dll,#1
  2⤵
  PID:3132

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads