7f4af8bf6568d684df93719bb2c64588ac3117885f07bdb7c46ce1d981a71013 | Triage

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 01:14

Sharing

Report Analysis Logs

General

Target

MSREPL35.dll
Size

405KB
MD5

a975d60b223e683c987162beb291b748
SHA1

a0f9f59c45550ca7e38de53a0ac375bd44ef9a87
SHA256

f72ce1881e3a944a3d6f97707dc38149ef36414b68611d00109f25e5d32de2b6
SHA512

771867594a64d63dfcf587e6bbb567b53b9e34dc0ae104ffc1c5f70680750faeaf19048e41c708f1e61e8dcce4a627564c12fe31dd16f3ec4c1414bfc841e1f7
SSDEEP

12288:qSA9o0vPdxRpZuieuI48Q2Uea/IbqziHt2Mtmh:qSKo0ndxRpZuieuIJQ2Ueanzu2q

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 4504	3816	rundll32.exe	87
PID 3816 wrote to memory of 4504	3816	rundll32.exe	87
PID 3816 wrote to memory of 4504	3816	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MSREPL35.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MSREPL35.dll,#1
  2⤵
  PID:4504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads