2afb5303e191dde688c5626c3ee545e32e52f09da3b35b20f5e0d29a418432f5 | Triage

Analysis

max time kernel
1160s
max time network
1165s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11-02-2024 15:36

Sharing

Report Analysis Logs

General

Target

x86/plugins/ToolStatus.dll
Size

223KB
MD5

837ef2b8f202ab9f53545fa2bc7fe71e
SHA1

4fb675056cdcf97a6fde847bcdb7d8d591771387
SHA256

a4ef4fa8a094983ca9a532dad9866e27d0211db98a5def3a3c4eb73f6d92d233
SHA512

d39b000d6d31bef3cf053443f3576318198e2b6ed180a0e4344dfb44c0d5549f09192455a4a2c55860c34723f50ac1dda23264259083a7b182fdc1a6d366a481
SSDEEP

3072:C8faMRFQENjlUcykpTRem9Z4wZOeb299zBwJY3G5:C8fFQEzUE9Ceb21wJY3G5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3728 wrote to memory of 3336	3728	rundll32.exe	84
PID 3728 wrote to memory of 3336	3728	rundll32.exe	84
PID 3728 wrote to memory of 3336	3728	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\plugins\ToolStatus.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\plugins\ToolStatus.dll,#1
  2⤵
  PID:3336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads