2afb5303e191dde688c5626c3ee545e32e52f09da3b35b20f5e0d29a418432f5 | Triage

Analysis

max time kernel
441s
max time network
1161s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
11-02-2024 15:36

Sharing

Report Analysis Logs

General

Target

x86/plugins/ExtendedTools.dll
Size

171KB
MD5

013dbb7c2ad8ba8b253a79c38caa5fe2
SHA1

5843281bcf9ee9bbc07179ef5032b5b7c8dcc555
SHA256

b029eb3a7444fa333daf8410dad0f770e2e9ff57a3ba6bbdd8b5d2696f43646d
SHA512

34d79a48a7d1af61f79c5f5dfa3fb5ce4f80c96ca078b343f03b57dfa8ab180a1ace9ff7501253c4a30cd2f1122f9154e2bfad8ea8b0aa31707e3ba31859e126
SSDEEP

3072:TACydNlIeMYoFoafAYDhjstr3cU/exUyND5VpCb2:TATeiNc3KU5Cb2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 5084	3364	rundll32.exe	85
PID 3364 wrote to memory of 5084	3364	rundll32.exe	85
PID 3364 wrote to memory of 5084	3364	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\plugins\ExtendedTools.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\plugins\ExtendedTools.dll,#1
  2⤵
  PID:5084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads