5341b3921b75549adbe59365517c30bd045e63162728d9ba48f79832fea1bea0 | Triage

Analysis

max time kernel
132s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
24-01-2024 17:21

Sharing

Report Analysis Logs

General

Target

ConnectifyNAT.dll
Size

288KB
MD5

d1e979c80f3a75fdab05462dad383bc3
SHA1

e8ef2c8fe5b45888020dce862dd4c7ae59c0be20
SHA256

9bfaa78a288f894ead9bbe616b24c777c5da76ffbc9ed03aa3d8e4a3c954ffe7
SHA512

ff2a2970988b7abf4563b94908a355d49720e993750807ee64b7f0439c0f1dfdf6aa0cea5323594ecf3f8094698408f02d665118b1c8710643afecf61f258a65
SSDEEP

6144:Tj9PE42T+v4PlM+IsRb+q1jrdVrNGZam0Z4Ocy:piaq1j9o90Zlp

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3124 wrote to memory of 628	3124	rundll32.exe	rundll32.exe
PID 3124 wrote to memory of 628	3124	rundll32.exe	rundll32.exe
PID 3124 wrote to memory of 628	3124	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ConnectifyNAT.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3124

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ConnectifyNAT.dll,#1
2⤵
PID:628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/628-0-0x00000000028A0000-0x0000000002A47000-memory.dmp

Filesize
1.7MB

Download