8d2f02a55a6957c8b8013d5df7837cbc836fa1e599d7d7eed4f1ef4a42f7fb8f | Triage

Analysis

max time kernel
93s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 05:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

SnagIt 8/Lfwmf12n.dll
Size

48KB
MD5

5fa3f1ec8b01a35105752421075ca20a
SHA1

c3e5018e84a8368e3bbc81282725cfe4df7df48c
SHA256

02690807b4b0103a458903cf9c32257c6518bc274392e583a752c47e5b40e925
SHA512

efbda349dac826e514ccaf238f2b4a6b42b185f4e17fb646f84d6e276df8a448250938209ae13e8319e74e12b6f86c209844d5c8b204521589cb18678ae82717
SSDEEP

768:H0GGBzAf+aOkqJxxM8n4Y6DuRNCDWlo2tH4NSPl8jg2NN:tGFG8nxD/CDK45g2N

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 632	4956	rundll32.exe	83
PID 4956 wrote to memory of 632	4956	rundll32.exe	83
PID 4956 wrote to memory of 632	4956	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SnagIt 8\Lfwmf12n.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SnagIt 8\Lfwmf12n.dll",#1
  2⤵
  PID:632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads