4aff974db2413e19562609cfa92f7a0c22a1f392c6b44fc0305740f79f323e9d | Triage

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 17:11

Sharing

Report Analysis Logs

General

Target

Funshion/LangResEnAmerican.dll
Size

104KB
MD5

4e34ae558dd4d3364f757d4161ae4e00
SHA1

b4d119f2ff69e47ac19eba567d36cc769c1ea2c9
SHA256

ce389207c8fb623bba59d21214001f1f6099b8a4b2f146472583b8844c69b546
SHA512

183d9c0ea1754dd56869e3699e8d7f788ff6dd105b826d61d87d563bbe4489dc3615a0d52d78e9d600becd6f0657f66cda70e3de43ef906608d7b9b01ef0f05e
SSDEEP

1536:Q+2n4lUo5XEG5mIqNAnBK4pmc4RoNJRLN4R:Q6+G5LqNeB/mGNfLWR

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 1484	4916	rundll32.exe	20
PID 4916 wrote to memory of 1484	4916	rundll32.exe	20
PID 4916 wrote to memory of 1484	4916	rundll32.exe	20

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Funshion\LangResEnAmerican.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Funshion\LangResEnAmerican.dll,#1
  2⤵
  PID:1484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads