b9973ba3407e32e942f5873c609b4552ce787e79df192f6588292f23080e08b8 | Triage

Analysis

max time kernel
90s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-03-2024 13:14

Sharing

Report Analysis Logs

General

Target

mc chet/shiza.dll
Size

3.1MB
MD5

50c8d7a2a9d55f2e1fdbadace74f441e
SHA1

ef56f6238807272a5ae49f169249d5537ed2bd2d
SHA256

cf8d269b34cadf7e6eebcd8ec1b7da74c5e2bb3e906c0ff813aec5ce6ced98ae
SHA512

20ca939dc47bb8dcc1ed950ece65b8fef745c9eeedf4a4cf15c2da52d0d0511ee50eb272b2ba0d66c563fb155df1452c25e5aa4d7061c2cf583e2d666775ca0d
SSDEEP

98304:UtuQrJlLHUm8g6GWbj0JnNgCsIuv4I1pK81NicD:UtuQJv6GA9Cs/VpKSN5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 4780	1044	rundll32.exe	88
PID 1044 wrote to memory of 4780	1044	rundll32.exe	88
PID 1044 wrote to memory of 4780	1044	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\mc chet\shiza.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\mc chet\shiza.dll",#1
  2⤵
  PID:4780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads