c37a5bd22e9a2565e57e81ce8d97a8d6aa17633ad819607f34ea924d00f9944e | Triage

Analysis

max time kernel
140s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23/02/2024, 17:56

Sharing

Report Analysis Logs

General

Target

00113722_XP_Vista_7/_Setup.dll
Size

160KB
MD5

30ebd4e80b1dda05eac709a1dc5965b4
SHA1

2418232370026574baabc84b105f6dd9e458ad86
SHA256

8802e54ce01babf7bb22d0da5c83bebc5c05d0ccd73566a5f836690e9278a696
SHA512

5115afea66734fe53c9479a6569b7fbc1ef395432781367cd68c7f4878ca3884bad0a960f76db2a40314484f329c4288a6ecf4a93cc49642c5e412448c5a2557
SSDEEP

3072:Eb9YfMX0E9QsJB9cWe7Ka2coNfCp5CzQQfnlS6LlwYKU7:EKlua8NfCp5CcS7

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 2436	3300	rundll32.exe	85
PID 3300 wrote to memory of 2436	3300	rundll32.exe	85
PID 3300 wrote to memory of 2436	3300	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00113722_XP_Vista_7\_Setup.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\00113722_XP_Vista_7\_Setup.dll,#1
  2⤵
  PID:2436

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads