0a028766093d0b322eaf803dc600e0e7a9cb303208559b25764f26d6ed897bb6 | Triage

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 08:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

147415543/BIN/BAS.dll
Size

252KB
MD5

e19fb40f1a90d5777613cc889e95a930
SHA1

5fd3205e68c3ada7a6002c73119bde195af0ba2a
SHA256

47a69230666fde35549e26fd98efd7b84c7d39f2779b69c6e2876beba9595694
SHA512

8e5ddf499f237678b46214ce07417cfa3edb008eb7275d07d63ca39e6e7651c238aad2c9a846de04eee18825457b8a83cbbd6588316e294081a620f19191d0ab
SSDEEP

6144:nz+N0JaYZEGB/O2fFiF0cVyYJ2KoJ1JZI8BwHoYt9FwLms:99XY0mP3onoob

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 648	3052	rundll32.exe	89
PID 3052 wrote to memory of 648	3052	rundll32.exe	89
PID 3052 wrote to memory of 648	3052	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\147415543\BIN\BAS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\147415543\BIN\BAS.dll,#1
  2⤵
  PID:648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads