e50f4c6c5ff5c515a5cf1428b4796c336c42c5d9797960c7882ea10044cdaa2c | Triage

Analysis

max time kernel
139s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18-01-2024 08:54

Sharing

Report Analysis Logs

General

Target

en/TNrgyModbusServer.resources.dll
Size

4KB
MD5

6a7abed5a1ecb059d4a146b1bd306247
SHA1

4cb0fafccb33432208246266ee6b638f9380e053
SHA256

afa0a2d2b258588c636ff386d2d82bb4186cdf1ecb647dc19882eae0f2caea5c
SHA512

fa9d22e0249b5543f1aa5449277e2582916f469cd28532574327a40dd83253bbba5792d3fe0afdc399ef18870bb71eb0a5272b652d806dbe25ddfc2a7c883773

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 4168	3968	rundll32.exe	43
PID 3968 wrote to memory of 4168	3968	rundll32.exe	43
PID 3968 wrote to memory of 4168	3968	rundll32.exe	43

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\en\TNrgyModbusServer.resources.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\en\TNrgyModbusServer.resources.dll,#1
  2⤵
  PID:4168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads