0a028766093d0b322eaf803dc600e0e7a9cb303208559b25764f26d6ed897bb6 | Triage

Analysis

max time kernel
151s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07-03-2024 08:47

Sharing

Report Analysis Logs

General

Target

147415543/BIN/STR.dll
Size

252KB
MD5

9f1b44d4548729a4f493e8b47dac1ec0
SHA1

9a1bf448b8ec3b840e35b0facc1924ef3f3b1f8b
SHA256

4d3cbfe768c2a8be31d76b9d3188f58f06895871bb41f76493f93dcc239fc5a5
SHA512

15733b0e7779d4b964db8fe52bca9d07672ec6c6e9e50d02d9f174010fc8f9f743764dd232020097f477f7162c0ce4c636dfbedf97eff1d50d210f1899f307e6
SSDEEP

6144:dPxZOE/6sQRzfWro+obdgAfYQJgcSBKjoNt9Nq:xDOESzpdjLvSojo

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 2852	1840	rundll32.exe	89
PID 1840 wrote to memory of 2852	1840	rundll32.exe	89
PID 1840 wrote to memory of 2852	1840	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\147415543\BIN\STR.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\147415543\BIN\STR.dll,#1
  2⤵
  PID:2852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads