8daf2a0088faa54e2c2720af17559507bc68e318b080176895bdcb22edf01d5c | Triage

Analysis

max time kernel
93s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20-02-2024 09:07

Sharing

Report Analysis Logs

General

Target

masScan_1.6/Packet.dll
Size

94KB
MD5

1250bef11bfa086f772cd2a273bc036e
SHA1

bfb60b4072f4533d8497f3d90631f818e345bcc6
SHA256

6b19cffaa2bf4359be1a0130a1fb47ab45e8c3be5d0cb7986579c5e04e1d77a5
SHA512

76cbc346468d400c4e6a95b3c91abfec0a63a375aade6f47c70a3b3db76c513bcfd91ed2994059a6c8bdd6b266f9b17ecf11f9941481c7a2692925d2457f5bba
SSDEEP

1536:6wG9plhvRIRVC2wJAyPFCnPKc0z70yIKtIn8zVpWj:E9rjh5t9cZyIKtInb

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3152 wrote to memory of 4908	3152	rundll32.exe	rundll32.exe
PID 3152 wrote to memory of 4908	3152	rundll32.exe	rundll32.exe
PID 3152 wrote to memory of 4908	3152	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\masScan_1.6\Packet.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3152

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\masScan_1.6\Packet.dll,#1
2⤵
PID:4908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads