2afb5303e191dde688c5626c3ee545e32e52f09da3b35b20f5e0d29a418432f5 | Triage

Analysis

max time kernel
440s
max time network
1166s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11-02-2024 15:36

Sharing

Report Analysis Logs

General

Target

x86/plugins/SbieSupport.dll
Size

81KB
MD5

4daa3b45699017dce248b0e6f634885f
SHA1

c155ec9e2b1ab9b6178074ac3f7900bedff89cae
SHA256

d28a6bd0cbbe33c05586edbfa7266c85355e5762afd89a3633a23136723b625e
SHA512

a0e05a0aac333a7f62961e77f6ea1587bb16a986cf7cbd24f0f39942bf4403b9438f98e553c72643ead742590d0f300b605027cc9bc92a47a523167e2f2765e2
SSDEEP

1536:c1CLBSfuO2cTwGQXmj51Dds5Ecj3ksWhcdgZCnQnmxukfK1:c1CVg51Dpcjlg8nQnmxuky1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 3624	4516	rundll32.exe	83
PID 4516 wrote to memory of 3624	4516	rundll32.exe	83
PID 4516 wrote to memory of 3624	4516	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\plugins\SbieSupport.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\plugins\SbieSupport.dll,#1
  2⤵
  PID:3624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads