e3bef3c169ed317c459bf9d52958a6ae4d4bf753ba6224ee4878e6bbddca067d | Triage

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
14-02-2024 02:03

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/KillProcDLL.dll
Size

20KB
MD5

e725dd273d5a8cf4386280436fe968ef
SHA1

6487e0c872c175991914378402572b806fcd1c8b
SHA256

22432bb3b215f61665f14ba375c9d2e52b84d748d11ba26427b0ca70e674b415
SHA512

4eb47aefa50255afd0fb54df85670da37548a5502219f21c6067239cdbad0454dd66f05eed2f2d310151b88902f2bd0240cce9e3a1665ab41cb3bb43ba99c2f9
SSDEEP

96:08S8CUNqsthSo5G+FUMlxTFqiwJQAgyUE1fb+4:08S8CU4stV5ozcyI4

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 2772	1224	rundll32.exe	85
PID 1224 wrote to memory of 2772	1224	rundll32.exe	85
PID 1224 wrote to memory of 2772	1224	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\KillProcDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\KillProcDLL.dll,#1
  2⤵
  PID:2772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads