87ea69570136c63736d95fd3950e11c67fd37ab1053410bc9e4aca66805a4cd9 | Triage

Analysis

max time kernel
199s
max time network
262s
platform
windows10-1703_x64
resource
win10-20240221-es
resource tags

arch:x64arch:x86image:win10-20240221-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
11-03-2024 18:53

Sharing

Report Analysis Logs

General

Target

Geode.dll
Size

6.8MB
MD5

7502d8873ce70ddd59e348c29183ed85
SHA1

ac5df33b02c299b3880e4d71cde8f5b21361c3a7
SHA256

67ba23a77ab8cdbb240775185394263e2a0c4b0fe88d9dad9f3837ca6c382c39
SHA512

dd18cc1bd423c73dffbff8126c3a1b24bc882ac9b34fa275128a9ba4fecb22014efbe6c0998268b638bd0ed3928377faef426bce25815042d37659318e6091bc
SSDEEP

49152:K+RiFPY39QoGR/HUYD+eXoKWwvlKg5RYfqBrSQ0FXrs8VOW:vR3NGR/0GX3vlKfql0Vrs8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1048 wrote to memory of 3172	1048	rundll32.exe	rundll32.exe
PID 1048 wrote to memory of 3172	1048	rundll32.exe	rundll32.exe
PID 1048 wrote to memory of 3172	1048	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Geode.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1048

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Geode.dll,#1
2⤵
PID:3172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads