66e9f4d03e67dbcbd9d3a13bfc45b2c11e712b677e990e8ea1b405b60a3a40b2 | Triage

Analysis

max time kernel
1718s
max time network
1172s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 09:34

Sharing

Report Analysis Logs

General

Target

Resources/FileExt.dll
Size

395KB
MD5

3db5b47fb70b114d6e5248d34a096ab3
SHA1

93271b2b594f85c0e2c196a87c9d77131b1389ab
SHA256

5b96abac3cdf98a3b9c22faf5a8880517027a3be948eea518ed2cc23bea53df6
SHA512

b02a58e8e1c74e8c0e0f9113a8a7a35017acfc9b566c73a970d287529b9e64c41e2adccbc1adf550f7c5acd2bf822c96682e9402a996027101a75292be1a600d
SSDEEP

6144:iQndDaFksddTkiHoKmM7Jt9y+c8WgLkUtAqz1RQy7y4fArT:iQdlYpWgAcfvy4C

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 1624	5040	rundll32.exe	89
PID 5040 wrote to memory of 1624	5040	rundll32.exe	89
PID 5040 wrote to memory of 1624	5040	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Resources\FileExt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Resources\FileExt.dll,#1
  2⤵
  PID:1624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads