be68c54bf25595d493a529c7f64ea38629b44f07c4551c208752b0b57060e2ae | Triage

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23/02/2024, 22:07

Sharing

Report Analysis Logs

General

Target

AnvirHook65.dll
Size

104KB
MD5

79712c891558ae2790aa88a8e5cf6059
SHA1

8e75f8dc4eeab4055ca4e2bc7950f178c9f002e9
SHA256

a256ba508d443da0a5d0f1b95f9cc9c8ee0fc0ed841ed0dc0370584a39dbe246
SHA512

84de473b4859bb2cb008eb51c2eb4a1511ca42eb8fbb8bdcbf6f6fc0404eb0b6d7222afa9b9772e4463b2f3120df75fe318e9343c111a71b91b09c54ca902aee
SSDEEP

1536:Bi43upZwPzslWWmaqAXLEHB6FggbwR9oIoDtRxUQJEYbtZNRr2ofe:F+vwm37GB6+Irt0QJE+two

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 760	2272	rundll32.exe	85
PID 2272 wrote to memory of 760	2272	rundll32.exe	85
PID 2272 wrote to memory of 760	2272	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AnvirHook65.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\AnvirHook65.dll,#1
  2⤵
  PID:760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads