9ff40de5a55aa6b5cf34c61acd52a26f77c6eb5cf1d464e0e651a046227a7b78 | Triage

Analysis

max time kernel
130s
max time network
131s
platform
windows10-1703_x64
resource
win10-20240214-en
resource tags

arch:x64arch:x86image:win10-20240214-enlocale:en-usos:windows10-1703-x64system
submitted
18-02-2024 16:09

Sharing

Report Analysis Logs

General

Target

expatai.dll
Size

400KB
MD5

dd55071ced298687339566cbe9b23c40
SHA1

1b5f760daab97658f7c0f7c28db35f10bde761bb
SHA256

ed10a005bbab4385775e5964586bad0c1d267edbf87ce98feb3cc7135877cca1
SHA512

ae9753860775be0039463c408e080a2541465562702c2407b46d3ab15dacdae6721325eb60ae72e0b389da2524e6122593a6f9bf42f1c2df5c2cb8463c4026c8
SSDEEP

6144:0iKR+8NAOuiLSswqA5YcgU8IoIkfvvIsAOIjAOktasHaF:U+8TSpqA5Yo1kfvvIsqjM6F

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4056 wrote to memory of 1420	4056	rundll32.exe	rundll32.exe
PID 4056 wrote to memory of 1420	4056	rundll32.exe	rundll32.exe
PID 4056 wrote to memory of 1420	4056	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\expatai.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\expatai.dll,#1
  2⤵
  PID:1420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads