b8cb661ff6b8dd7be850a9ac2594a6bec1ad468316a8254470ff062112b64910 | Triage

Analysis

max time kernel
140s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19-02-2024 18:13

Sharing

Report Analysis Logs

General

Target

Geode.dll
Size

6.7MB
MD5

3df3962ef7974ef65e4ebb87aaf31ba7
SHA1

8b3100cc6b7a1a5af347e1ccf3e0f0f0a283065d
SHA256

a0c25fec042a599201d591bc9c61a14566e760ae4b54c82ccf3c671881e1a219
SHA512

d2df79d60775b62ad107dacb27418711b6e9e4d1cb3e217f5f3dbe986e685eb73817aba6bd92ac514441492b628161c69452f75272871d5f747a5b8c035b9966
SSDEEP

49152:avD8JWK3Cg5i8dLvafx5JBScwiGCFkaAguUvMiQ02PlC0Jdt3Pvvcs64WnJ:Vtd5tQx5J1wieguU60OlLdt

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1832 wrote to memory of 1388	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1388	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 1388	1832	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Geode.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1832

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Geode.dll,#1
2⤵
PID:1388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...