f6de40a0e0c5b51daa70456189d10f7fc1e7dcd36168cf8afcb17035efda6686 | Triage

Analysis

max time kernel
150s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16-03-2024 10:26

Sharing

Report Analysis Logs

General

Target

[3.9.9.43]/ConfSdk.dll
Size

1.3MB
MD5

b469a62b38b18869c3146b16652f7cad
SHA1

eba667eae4e894f9fbf1d67fde6665349480d27f
SHA256

cf6e5dd1dbd3e1963279aa5120adb2fb544817c3f74a2819ccbaa3c27773ffc6
SHA512

a5502bc2e09f218d3948fffe70e71cc7ec654e031f71357a78f06077a567b5a06d10879e2b1f4d4c96a4b56ea777e762ded457f33260c1f1f8f0a6718710141d
SSDEEP

24576:Y3Yptx6ZMFT8wnorDnD0ADl6dWmHc240YGr0fJIp:YjSFt46dWmR4zGrd

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 4152	3924	rundll32.exe	94
PID 3924 wrote to memory of 4152	3924	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\[3.9.9.43]\ConfSdk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3924 -s 432
  2⤵
  PID:4152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads