cbe5cdf7ad6e2c7b436b15be3f500205a5d62d9fe07f7744171a19e1486a176f | Triage

Analysis

max time kernel
165s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 23:19

Sharing

Report Analysis Logs

General

Target

asycfilt.dll
Size

76KB
MD5

7b50242f8556a469e479f65e9668addb
SHA1

b4fabd24342d6302d6f03d948dbfe525fa9e83e3
SHA256

df92721a51d59ee2d8128fd62b4baf4911393d6325932f09585acb0e71451f5e
SHA512

8a0fefdeca8f69336d14b3b411f9fc7ecdf9f5ca7861de52ec6f8a6784496e650f702fbf4fb09064062e5fb405d6a9ed8464f20c25d880ffbd30e5f75c605de5
SSDEEP

1536:el+FKPPGxOvz4C7qREVcyYrRBEY4ia0625OgwLpyhlwSfD9Q:eMKWxg7qiqz4v0625Oehmy9Q

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 4480	1008	rundll32.exe	65
PID 1008 wrote to memory of 4480	1008	rundll32.exe	65
PID 1008 wrote to memory of 4480	1008	rundll32.exe	65

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\asycfilt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\asycfilt.dll,#1
  2⤵
  PID:4480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads