72c96f7e2f4823bb9f28944c96aa1b737be20edd52ca97b699085d3498e4ab74 | Triage

Resubmissions

08/03/2024, 09:37

240308-llgz2scf9x 7

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 09:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/BASSMOD.dll
Size

33KB
MD5

e4ec57e8508c5c4040383ebe6d367928
SHA1

b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
SHA256

8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
SHA512

77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
SSDEEP

768:qQmS5iUgi5czW+DlrQOS1DeDdjgNtbX4O6DHix84H0:qQz5Tgof+DdpS1+djctLSHiZ0

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 3548	8	rundll32.exe	88
PID 8 wrote to memory of 3548	8	rundll32.exe	88
PID 8 wrote to memory of 3548	8	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\BASSMOD.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:8
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\BASSMOD.dll,#1
  2⤵
  PID:3548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3548-0-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download