ccc65cc16770cf1f444219f00680f9fe6234d543107e98413bb06c68aea92e86 | Triage

Analysis

max time kernel
142s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09-02-2024 08:09

Sharing

Report Analysis Logs

General

Target

Korepi/vgrl.dll
Size

3.4MB
MD5

15620a9f1936c028377523116e657b82
SHA1

be2d28d85af3c0e98884b6874f4668d361caf7c4
SHA256

786499d901e9b4f7d5f5d00847fd09ee6ddfebe7ef824c53b49e569a670d6e28
SHA512

1ae0c54dd997aeb9d95a5f78be98ebf66a022545ec6e61422fd8c754030ffec0485aabf3ffa7b9ca9feb7c6f638cde94c7335d56a17d9eb9fea2c179f2326f9a
SSDEEP

98304:LKdCMlrcK9LLB9h9qVh8jhYY5BFtvhxijrvGPSo:mdLlrfdh9qVhk5BFv8r+PN

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 4964	2012	rundll32.exe	84
PID 2012 wrote to memory of 4964	2012	rundll32.exe	84
PID 2012 wrote to memory of 4964	2012	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Korepi\vgrl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Korepi\vgrl.dll,#1
  2⤵
  PID:4964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4964-0-0x0000000074480000-0x0000000074987000-memory.dmp

Filesize
5.0MB

Download