4e68a591b4ed8ffe693619f7d98b7af388357eaf2d8005cf15b3fb5697fe69ce | Triage

Analysis

max time kernel
92s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26-01-2024 21:41

Sharing

Report Analysis Logs

General

Target

ChatRoomClient.dll
Size

252KB
MD5

10a7f9b81d94120caf39fd09f354f207
SHA1

ba5b377b7478ecd9cdc7f09f44092441eb355af5
SHA256

1e7c9fb93a52b460bc89f4598dae07b4e620ae5f576886d7d1806df2be772925
SHA512

6a66603f0a524fcd7628f43c2e3c63d0ae803fa4a18a3e0943d8bc80d3724e6262df9a7777a103118dc587207dcb5fadd1eff36b0719f7d550e142ce854ea36c
SSDEEP

6144:fVojANUqdvN3mDKTporQ+sukqfJqqDL6J:fvNUBDKTpZ+fkqfkqn6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 4364	4936	rundll32.exe	86
PID 4936 wrote to memory of 4364	4936	rundll32.exe	86
PID 4936 wrote to memory of 4364	4936	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ChatRoomClient.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ChatRoomClient.dll,#1
  2⤵
  PID:4364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4364-0-0x0000000000A80000-0x0000000000AB6000-memory.dmp

Filesize
216KB

Download