209113be716dd92ebbc8da1c9aa8bb22adfda1da32e168055f3a56b1ddc0bbd5 | Triage

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
23-01-2024 23:55

Sharing

Report Analysis Logs

General

Target

$COMMONFILES/ParetoLogic/UUS3/UUS3.dll
Size

389KB
MD5

e67d6c7c53aa79770425c756aea71283
SHA1

e295fed1a41cec12fb10e5fd9fb6ffcdc2aabe70
SHA256

b47d0897d1ade2ec3636e52265e2603870226b04085ce2cb6ee5301e7f4b8b74
SHA512

b044bc2b08799469e9708286c4fd2fcf7e6d5b12e543c7b6572f599589f5afe5b6e7d6589a54c6c19754395e7dca246dfa7187d236e941a944642c25c66bd8dc
SSDEEP

12288:S/fHAeW9e/7FKKBpGDwJkChY/CCsU9okb7+mBFD/:C7FKK/GcrY4U9ZbrD/

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 5008	2748	rundll32.exe	87
PID 2748 wrote to memory of 5008	2748	rundll32.exe	87
PID 2748 wrote to memory of 5008	2748	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\ParetoLogic\UUS3\UUS3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\ParetoLogic\UUS3\UUS3.dll,#1
  2⤵
  PID:5008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads