2afb5303e191dde688c5626c3ee545e32e52f09da3b35b20f5e0d29a418432f5 | Triage

Analysis

max time kernel
436s
max time network
1162s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11-02-2024 15:36

Sharing

Report Analysis Logs

General

Target

x86/plugins/ExtendedServices.dll
Size

116KB
MD5

0c1a9c2a6190f1baab115316da215f89
SHA1

71326114c50ec7fd3afdf9ab43cc631fb32a40d0
SHA256

647611756cac85d8fcc8cd78efdc5712c68e4fe7bbcc8a64081900c68bcc0feb
SHA512

b7abf69665970cbfd7d07607a1b92048c499c15c1d17c10135c4c7e596063eabd17809e7073cc2fb4861b4275a3e88e767c43ab53785a20cdd18d79883b6d042
SSDEEP

3072:uSRJylyd/ga0uHdtBTIzBHdcAOcn3+0ec7bOH/:BRJfJMmaORH/

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 4912	2868	rundll32.exe	84
PID 2868 wrote to memory of 4912	2868	rundll32.exe	84
PID 2868 wrote to memory of 4912	2868	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\plugins\ExtendedServices.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\plugins\ExtendedServices.dll,#1
  2⤵
  PID:4912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads