e50f4c6c5ff5c515a5cf1428b4796c336c42c5d9797960c7882ea10044cdaa2c | Triage

Analysis

max time kernel
145s
max time network
45s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2024, 08:54

Sharing

Report Analysis Logs

General

Target

es/TNrgyModbusServer.resources.dll
Size

4KB
MD5

b4fc270d0198ac485b853837bde48531
SHA1

4c5a4ac5e90aa12a1ea65ed039674a9458a6f425
SHA256

896fa2c8e3228dcbbe5d52eaf4f22baf20fc084161378e8d02c120faaad7fd08
SHA512

1d9eb77f4bfa78abf845c0914df553902bc55b550a3b657f1a20e2fb395f79bc6e6b7a1f220aa04fb011fa966eafdb466f5566d2ac88fc4b0848443c88f560fa

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 2576	1380	rundll32.exe	12
PID 1380 wrote to memory of 2576	1380	rundll32.exe	12
PID 1380 wrote to memory of 2576	1380	rundll32.exe	12

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\es\TNrgyModbusServer.resources.dll,#1
1⤵
PID:2576

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\es\TNrgyModbusServer.resources.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads