c5eaaefc4ed4c122eb81710b1e4cd97e173cc9d088306a202701c5eee647655a | Triage

Analysis

max time kernel
92s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
07-02-2024 02:04

Sharing

Report Analysis Logs

General

Target

Bin/AppModule.Struct.dll
Size

16KB
MD5

9c89ef540cb0a1080b526bdc2d898088
SHA1

2d47cef944274933193fdcea57606067ce514c3a
SHA256

3a2666a46067800d654cacac691ef572cf4c2a029d68023d90d121b3926f9761
SHA512

cfc2c1571ee28d3504d8a4426d1029f1c60a041a93507b7478f1468306ddf131dc61176a4d83b6ab772529e3234a18a1958897694a24d35960e6ef4e3ed3f7a2
SSDEEP

48:6U/+zRLMv3XjTn3XBA72JU1If1W7/z6/S4lSDDlSbKG:oq3TTnu1M7ZlmDl

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 1020	4652	rundll32.exe	40
PID 4652 wrote to memory of 1020	4652	rundll32.exe	40
PID 4652 wrote to memory of 1020	4652	rundll32.exe	40

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Bin\AppModule.Struct.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Bin\AppModule.Struct.dll,#1
  2⤵
  PID:1020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads