3c98ead4523e58fa993215b0536711d1e8d99be715b1f62855a3b39a0d879d8b | Triage

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 21:47

Sharing

Report Analysis Logs

General

Target

51Logon/recommend/Dll/LogonBBS.dll
Size

216KB
MD5

47f868961c81b8d24322a2808cb69c19
SHA1

41bb9174de43d344fd9ca9767766be1a4cabfe6c
SHA256

02c8dec1e8401c8742872f00a615c066ff37f30d5330a289fc18c58d0c49f24a
SHA512

90ef557b5ca5d54c91aee85ac4ae61c675005d42b3f187e0874c1c836a4d0f38a236e147919c40479afdc8ed2f577131529e8a2c0dab2672343be46f88c5ea5d
SSDEEP

6144:ZHoxysu30Q2jwDMUwWmOMlGLhS8lPyT/dZX:ZI0k0DMzkMotSeI

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 1328	3124	rundll32.exe	89
PID 3124 wrote to memory of 1328	3124	rundll32.exe	89
PID 3124 wrote to memory of 1328	3124	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\51Logon\recommend\Dll\LogonBBS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\51Logon\recommend\Dll\LogonBBS.dll,#1
  2⤵
  PID:1328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads