a3924df964a4e90c60ab76c7627706dd4986c06c3c513b9dae66d2cb9dc80fe1 | Triage

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01-01-2024 08:01

Sharing

Report Analysis Logs

General

Target

lib/GimProc.dll
Size

144KB
MD5

379d6573916fca35f661e8817f6082dd
SHA1

1a68c328cefc90b2960759f3e87131fd8a24575d
SHA256

39e5cafc7000417e7d082e6b2d5234904b451c865644ebd4ae04d91392489930
SHA512

c37aecec928af864dddd4ba08afb409e9c0be8dd20a1f423b9618aff8c033ffe12df527d2b5bebcb90ff77f402528ff4374e2ac8c18d225ca23ca3800659c878
SSDEEP

3072:VWQ20/YwjqdXrzvHpTOWFz0zCXW120JyV6dmyLVURiRyh:VWQ2IEpaWFzYCXPsyV6gRiRyh

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 3212	1508	rundll32.exe	86
PID 1508 wrote to memory of 3212	1508	rundll32.exe	86
PID 1508 wrote to memory of 3212	1508	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\GimProc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\GimProc.dll,#1
  2⤵
  PID:3212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads