c4a23bb6f2f1cb4b5a9cc64927c27b69b269f853da89ba0e67ef1f15695873cd | Triage

Analysis

max time kernel
133s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2024, 12:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

kun-public.dll
Size

12.3MB
MD5

7cc0c1ae79afa0bba077d8107d97b9d9
SHA1

aade23e09acd53f107899888b005716114820c22
SHA256

1eacad4d68f662c3c8787c6b5e85ef8c22d930b5566dc731d614d865ec3c8975
SHA512

8b2c542e19e2f950b72363b8d58546669f161406913a1d46c57366964a15efd210bd8e561e21c1a7c46223fd73574356336acc877b2e200014ab3c965c58432c
SSDEEP

98304:xUJr6weRUmegEtWICCd7MhNx+vX1VLTGhv7nWUz0qeWr0QaQsns:x11HIlONmfT8v7nxz0y0QG

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 1364	2580	rundll32.exe	89
PID 2580 wrote to memory of 1364	2580	rundll32.exe	89
PID 2580 wrote to memory of 1364	2580	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\kun-public.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\kun-public.dll,#1
  2⤵
  PID:1364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads