a04acef29fbfd30b1b63dc6c69717506e2f95d01565b0fba9d33754b9886f459 | Triage

Analysis

max time kernel
141s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-03-2024 23:12

Sharing

Report Analysis Logs

General

Target

vp3pl.dll
Size

63KB
MD5

648f604f4c0430787f36f3b65f36f60e
SHA1

aaf42e82f53fb656710a72ae27ba87f4218b09fa
SHA256

94b97e1d81965e30a1949d39217630a2592929274dffc7260fc8bc9b1b1f7dda
SHA512

a66417c173982573030905352560a8da6204c3e3887266cb09cc01c88167cd33ec27fe73ff5e5c8dffc3334745e94c3a26dfbe734fa250dc0f908cd94bd59cd1
SSDEEP

768:hATmq+Q6vwHC6r+8Y8ITRXXG9LLPH0E5Ww2bHE5v4jtCDscx88e5pWghug3n8z95:smq+QJlLmW5KQX65pWJgAfx

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 812	4984	rundll32.exe	88
PID 4984 wrote to memory of 812	4984	rundll32.exe	88
PID 4984 wrote to memory of 812	4984	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vp3pl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\vp3pl.dll,#1
  2⤵
  PID:812

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads