a148412a5c1cc9aba0ecdbb3e44010aeac75b40f23492bd04c0127e558aa44ac | Triage

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2024, 04:31

Sharing

Report Analysis Logs

General

Target

OfferBoxEngine.dll
Size

1.0MB
MD5

648bcb283d84f257184bb390d0d3a375
SHA1

35aeac1459e955f92eeb38074b6f8384843af6a0
SHA256

ba170abbf00b8a46a64626d30c2f39f2d69f4c7aaa7a0bddb4e2a79160cb2678
SHA512

f932f7ef1c72a1d2f327a497ad7ffd974fa85e21f67aed3a537c99d674665385751217b2b9fa7ef5c13bfa89a0c9d1c92065d365931335b536974a333896316b
SSDEEP

12288:tYGPUEJXolX0VuJhq1otALXnoYsXBSYmRVCXeTld2hlovcDhXxT:tmEVshE0XBSYY/TlOlokDJxT

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 4664	868	rundll32.exe	85
PID 868 wrote to memory of 4664	868	rundll32.exe	85
PID 868 wrote to memory of 4664	868	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\OfferBoxEngine.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\OfferBoxEngine.dll,#1
  2⤵
  PID:4664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads