8790f7c5e30df81d149fb13cdad3b594adfb7f66f46b03ad93aa22dfe792dab4 | Triage

Analysis

max time kernel
93s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 08:49

Sharing

Report Analysis Logs

General

Target

ManaBars.dll
Size

120KB
MD5

e59cd04e116709f8a6ae7666f4dd9d20
SHA1

31e80e9a564c137aaa7d7fcda03d86de6a5d4d97
SHA256

f0ecc0fafd6382767c4990e7003c920a1c6d06cb4f11036cff7b0dd444c0882c
SHA512

b49151dd7ec798fc71fb0dc6f0755e6138364a2873dd676e71b25f3d594efb76c7ce8979b3ce8d46b259a8b4105ed2076d63761f08c69b9830662a67170c2e79
SSDEEP

1536:6Gyf1zFFTaNFLb4o52fC2fFmxg41eEZFoVxV7mJBqdLhm97Ps9jINXfn:6/7FGDX2629b4DFwV42Z9jIB

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1992	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1992	1724	rundll32.exe	80
PID 1724 wrote to memory of 1992	1724	rundll32.exe	80
PID 1724 wrote to memory of 1992	1724	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ManaBars.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ManaBars.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1992-0-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download
memory/1992-1-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download