3343644e85fc33f8cd3b97e0f7275053f1c272932379c61b3c0d3c620a23a4ee | Triage

Resubmissions

08-02-2024 19:42

240208-ye7cksbg28 10

08-02-2024 19:33

240208-x9kavshh6s 10

Analysis

max time kernel
125s
max time network
132s
platform
windows10-1703_x64
resource
win10-20231215-en
resource tags

arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
submitted
08-02-2024 19:33

Sharing

Report Analysis Logs

General

Target

Korepi/vgrl.dll
Size

3.4MB
MD5

15620a9f1936c028377523116e657b82
SHA1

be2d28d85af3c0e98884b6874f4668d361caf7c4
SHA256

786499d901e9b4f7d5f5d00847fd09ee6ddfebe7ef824c53b49e569a670d6e28
SHA512

1ae0c54dd997aeb9d95a5f78be98ebf66a022545ec6e61422fd8c754030ffec0485aabf3ffa7b9ca9feb7c6f638cde94c7335d56a17d9eb9fea2c179f2326f9a
SSDEEP

98304:LKdCMlrcK9LLB9h9qVh8jhYY5BFtvhxijrvGPSo:mdLlrfdh9qVhk5BFv8r+PN

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 4812	4788	rundll32.exe	73
PID 4788 wrote to memory of 4812	4788	rundll32.exe	73
PID 4788 wrote to memory of 4812	4788	rundll32.exe	73

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Korepi\vgrl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Korepi\vgrl.dll,#1
  2⤵
  PID:4812

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4812-0-0x00000000734B0000-0x00000000739B7000-memory.dmp

Filesize
5.0MB

Download