616b9a060c397b10dbe81f292d7efede7865598af9c617f036b7395367b50f2c | Triage

Analysis

max time kernel
91s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24-02-2024 13:19

Sharing

Report Analysis Logs

General

Target

FreeImage.dll
Size

648KB
MD5

8cdaae887b036d5805b904285a039db1
SHA1

7d7fafa3f68a29ec4e95f1b1a537391c2475f517
SHA256

f90472bec5aeaee95b152d0c7bdd7afbb29ea91a11b865d6d5b6c520eafa2a90
SHA512

8cd0205409a4d832fd0880daee75677c38b78a885bb8d2650a9c051b90d3b97f314503e51103502d558d6e8becbe1a87f666866122ca9366a9d7521356522d84
SSDEEP

12288:Bu+2lpZf8QCmgRGnCIGzSVMbaan9phMPjgsu3jbu:J2lvUQ1gRLIGzSVMbaESjgt3jK

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 4420 wrote to memory of 5020	4420	rundll32.exe	89
PID 4420 wrote to memory of 5020	4420	rundll32.exe	89
PID 4420 wrote to memory of 5020	4420	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FreeImage.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\FreeImage.dll,#1
  2⤵
  PID:5020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads