325cd8cd74165c89739dc34ef141db4dcbbe849fbf63b952bd13f080e8506f8f | Triage

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 13:55

Sharing

Report Analysis Logs

General

Target

Help/ADRHelp.dll
Size

52KB
MD5

387f4eb938fe8ada0784a988a5e94afd
SHA1

037d276c5e3d6d514adc2fd1739bc172b9af3276
SHA256

d79953062082601ecf6893b6bb0bee9b6ef56fc906bb3565d827d6b712eebc26
SHA512

ab4f086adf0413fad60fd7f17e4a574ecfd61956dd9a313419494680041fe772b3f5f08b6ef639dbcfe9d4c8d5f86718199826bb55da6304b8d352ab4b8dab06
SSDEEP

768:zSTHvrRsUQbrSOhL/mxB+1PVBRiUdVtzlD:zS7yXphDmxUWMtzl

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 488	1988	rundll32.exe	87
PID 1988 wrote to memory of 488	1988	rundll32.exe	87
PID 1988 wrote to memory of 488	1988	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Help\ADRHelp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Help\ADRHelp.dll,#1
  2⤵
  PID:488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads