68b9dd84b3149ff163a50e4f2bf14821020723ead8050511535a7c775189d369 | Triage

Analysis

max time kernel
146s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2024, 02:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5224829/AI/06Snook/glut.dll
Size

151KB
MD5

357d2bc9cafbf1cd87e7706d9e638c0c
SHA1

522ad5825106dd7a67e8e222f65869f5b711e092
SHA256

fc98bb5f6b6e843f290e2c3487350d1032f194079f313499e2c48fac8aed23fc
SHA512

eb398f84f79e7bda99de69c123dfd8a7187167dc8380697b672e6da9aa396372fa9d23723f7011eb5a644b76ae27697d65c72d21805eb9c46429a39903150c0c
SSDEEP

3072:AOWO+yM/RdskInE5+ohOeocRGyrXdr93lnNxK+oJq:AOWXHW1E+MfRPddxNxKR

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 2956	5092	rundll32.exe	14
PID 5092 wrote to memory of 2956	5092	rundll32.exe	14
PID 5092 wrote to memory of 2956	5092	rundll32.exe	14

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5224829\AI\06Snook\glut.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5224829\AI\06Snook\glut.dll,#1
  2⤵
  PID:2956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads