3343644e85fc33f8cd3b97e0f7275053f1c272932379c61b3c0d3c620a23a4ee | Triage

Resubmissions

08-02-2024 19:42

240208-ye7cksbg28 10

08-02-2024 19:33

240208-x9kavshh6s 10

Analysis

max time kernel
92s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
08-02-2024 19:42

Sharing

Report Analysis Logs

General

Target

Korepi/vgrl.dll
Size

3.4MB
MD5

15620a9f1936c028377523116e657b82
SHA1

be2d28d85af3c0e98884b6874f4668d361caf7c4
SHA256

786499d901e9b4f7d5f5d00847fd09ee6ddfebe7ef824c53b49e569a670d6e28
SHA512

1ae0c54dd997aeb9d95a5f78be98ebf66a022545ec6e61422fd8c754030ffec0485aabf3ffa7b9ca9feb7c6f638cde94c7335d56a17d9eb9fea2c179f2326f9a
SSDEEP

98304:LKdCMlrcK9LLB9h9qVh8jhYY5BFtvhxijrvGPSo:mdLlrfdh9qVhk5BFv8r+PN

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4468 wrote to memory of 3668	4468	rundll32.exe	rundll32.exe
PID 4468 wrote to memory of 3668	4468	rundll32.exe	rundll32.exe
PID 4468 wrote to memory of 3668	4468	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Korepi\vgrl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4468

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Korepi\vgrl.dll,#1
2⤵
PID:3668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3668-0-0x00000000753A0000-0x00000000758A7000-memory.dmp

Filesize
5.0MB

Download