d82aadd3332d5302851bff734bf5c07d01265a2630a66fe959fb894964cb2d4f | Triage

Analysis

max time kernel
86s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2023 14:49

Sharing

Report Analysis Logs

General

Target

e_manage2JP.dll
Size

124KB
MD5

625d1add31f813e48df3a8470869aea7
SHA1

ef3a954a8895f0d94744b232961461af13d6d873
SHA256

a15ba51a2cf9478d00c3ac408586f0efdc0a957f2f47712355508786aa21a484
SHA512

ad452921ac6e9b2c61ccc1bb81d5ec4b0510d58df73baa8b68d208ded69d6bba47e899f2675be08b2165ea1a093c7d286ab3e9a8ee5a2aa808c54e076b798041
SSDEEP

768:1rXiH86uIJ96rbvbO+DachUoG3sp0XcWBqmo6:1rXi996/vb9hW3sKLB

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3384 wrote to memory of 3380	3384	rundll32.exe	rundll32.exe
PID 3384 wrote to memory of 3380	3384	rundll32.exe	rundll32.exe
PID 3384 wrote to memory of 3380	3384	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e_manage2JP.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e_manage2JP.dll,#1
  2⤵
  PID:3380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads