66e9f4d03e67dbcbd9d3a13bfc45b2c11e712b677e990e8ea1b405b60a3a40b2 | Triage

Analysis

max time kernel
1382s
max time network
1166s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 09:34

Sharing

Report Analysis Logs

General

Target

Resources/magic_cmp.dll
Size

806KB
MD5

deb5ced372164855fc94b74d0ca30988
SHA1

ecdefb239481acc977079d87a4763b14d3997aa4
SHA256

bc55dd40ce4a28c38312e7edcf9439581a93bc6b9450151d1b367ef803ae5c08
SHA512

6dc31231f0fa3e295622594a90a48bd26db6b240ae2a31663dc43e1efb76145c676bab9ee660ae0f2bd5a5cad00e96ffda82aecebdfc3c30bfaeed9fe01a308f
SSDEEP

24576:aW+wsDaQw6DDz3qRyPnmGfrnvVUKueY8Rm7eWtJN:aasY6DwOBfrnvV7oeWtT

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 2024	4192	rundll32.exe	89
PID 4192 wrote to memory of 2024	4192	rundll32.exe	89
PID 4192 wrote to memory of 2024	4192	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Resources\magic_cmp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Resources\magic_cmp.dll,#1
  2⤵
  PID:2024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads