0e24b8e9026309ce107cc22c3e37d189b3491a500c0282e029da324733772051 | Triage

Analysis

max time kernel
145s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06-01-2024 08:24

Sharing

Report Analysis Logs

General

Target

Plugins/MD_Fix.dll
Size

52KB
MD5

caa1300143a059a729e33bc60a516a33
SHA1

faa709a08ef572ed0ee362d68cef51a45119f1bf
SHA256

7994ff30d38bb813c21fc74c8d4825dff31bfa86a91c6a70ce696f4e5eaea1bb
SHA512

6e3d8f20f1ecb959776683ea43f4d15facfaf38c3b3b66225ba02bf18976fd4c9eab3c8d7e692213f916f1b8532b667ddeb8017a64a60584459e7a4e844bed6d
SSDEEP

768:G2hYJcwnoWJ/ZPXMRmrDX0u10UDXVpu7tgg:4JciZPXMmrDteUjVwtF

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 4588	1188	rundll32.exe	17
PID 1188 wrote to memory of 4588	1188	rundll32.exe	17
PID 1188 wrote to memory of 4588	1188	rundll32.exe	17

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\MD_Fix.dll,#1
1⤵
PID:4588

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\MD_Fix.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads