2afb5303e191dde688c5626c3ee545e32e52f09da3b35b20f5e0d29a418432f5 | Triage

Analysis

max time kernel
451s
max time network
1170s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11-02-2024 15:36

Sharing

Report Analysis Logs

General

Target

x86/plugins/UserNotes.dll
Size

96KB
MD5

7de6aa4f0d79e4b243a66b4db6f17fe9
SHA1

0137fd9f2e0115e88003b80942b137ad83b52f5b
SHA256

a94d02d9645a4f4fe0388bb40775862aa3f90d22a93fdb14870389ab891b486d
SHA512

1fa4216fcf84663c185a2b244055d93b25a3242d79699a7973dc0ea50b80c4cd21df52cc6601868c9d68591d667130f4b2408093ea93641a14a352e8788d1bee
SSDEEP

3072:mEuN4hL6EK8WvWCR3RPPp9KjqzUJEAElDBUh3:9L88Wz3zYKKh3

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 4824	4624	rundll32.exe	85
PID 4624 wrote to memory of 4824	4624	rundll32.exe	85
PID 4624 wrote to memory of 4824	4624	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\plugins\UserNotes.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\plugins\UserNotes.dll,#1
  2⤵
  PID:4824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads