33a1c7f4799b940d2a1e9766e4b37cb298f40377982ac4773443dd500aaf085e | Triage

Analysis

max time kernel
93s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/02/2024, 16:59

Sharing

Report Analysis Logs

General

Target

MSSETUP.dll
Size

276KB
MD5

2b1d27a3b504de769a3c0c4c582fc9ad
SHA1

3d2b651d2e2386f4ffe1d418165611ba165ca1e6
SHA256

61d84dd065a4e1be2c491a8c435d0f17a0d9708d9af8d59bfb7c3c3cb6a6154a
SHA512

8bd738586903df032e40b4b3e3dac3634f5d851efe01def53ca5e16c46609442f68bcd4f5ba073a9e1925e8bd0e50e5bb3bb0ca6d886de429a0993bc9a5e0ad4
SSDEEP

6144:sXz52XinuTJuS7KSg0KkNSXXCy7VxdDfXBt:SF2Xiu9uCxpKkNUjDfB

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 3692	3952	rundll32.exe	64
PID 3952 wrote to memory of 3692	3952	rundll32.exe	64
PID 3952 wrote to memory of 3692	3952	rundll32.exe	64

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MSSETUP.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MSSETUP.dll,#1
  2⤵
  PID:3692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads