df430e88e62b426b7c75ba29eb28eff3b77714999a28c6f9aa9172085f78cd3a | Triage

Analysis

max time kernel
136s
max time network
316s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-03-2024 00:18

Sharing

Report Analysis Logs

General

Target

sureware.dll
Size

16KB
MD5

e4bfc50773736ff66ca29e2c1ba45e8b
SHA1

bcc6b879713e8bb261e291f808cde6e722858498
SHA256

d570ac651a95a266c46a7ddfca910c06b28893079ef9968e5c9986609737f49f
SHA512

cecf2d4eac74222430d648b7d9dc792a906935cfc6f4ca269dd0e98a8f3258fb9b1500287d24f2ecc30a6237b9a12380970af5d5cfe79e28103e34121bc3f595
SSDEEP

384:8Q7xtCwkiHfidJmYy0VPAR7pFgOky7/xPEjd:8xAZmARlvk+tE5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 4472	1488	rundll32.exe	87
PID 1488 wrote to memory of 4472	1488	rundll32.exe	87
PID 1488 wrote to memory of 4472	1488	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sureware.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\sureware.dll,#1
  2⤵
  PID:4472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads