37ffba131c763e2630433b2865a8149508af32f387fb5808cfaf539815bb5077 | Triage

Analysis

max time kernel
128s
max time network
136s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
23-02-2024 10:15

Sharing

Report Analysis Logs

General

Target

data/WCMICON2.dll
Size

1.5MB
MD5

e27082b0866a67ce44e1b87cf49a59a5
SHA1

9307b91833f8234c34d797c0feb4538e3be497f7
SHA256

9f1ee34b38da173f59bdf6172198ff2ec872fb75bc09ffa55cc3847ecda14cba
SHA512

8ee78da80693d5eaa49db85e1c3c0c3b94d70e17f6a8390f35c4a89aa08bc65c6aca05100c05ae32d789f1dc8e4cf23585abba1b6193a647c891daffaffc9fe6
SSDEEP

6144:Kmj3ztvZEMClzfNWzdL9wcQuoJtiY/smNtplZ8j8YhpLaJIBRRi:KEPp9xQrJ0sZ8jl/3i

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4808 wrote to memory of 696	4808	rundll32.exe	rundll32.exe
PID 4808 wrote to memory of 696	4808	rundll32.exe	rundll32.exe
PID 4808 wrote to memory of 696	4808	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\data\WCMICON2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4808

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\data\WCMICON2.dll,#1
2⤵
PID:696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...