96820541e563ae6bd9e97a0ec95bcbc5e2044dc89574d3c8d0b7b40edc276222 | Triage

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18/03/2024, 21:34

Sharing

Report Analysis Logs

General

Target

$SYSDIR/asycfilt.dll
Size

63KB
MD5

18e9e721e2d9842a62a3028a55a45897
SHA1

d94dd3d3dc4c6578b5571e93820c52544f9c68de
SHA256

bcbc5fc2cbde5e2c13f4727b79de872370c2f65456871dd66d38e4128025bee2
SHA512

88b882c0a0c91aeb98291a1351e9e0fbf86fc0631ca3ea81cef0f3b7db1ab68ed8ce5a9f64174ead183c9d975b420e4349da5e8130aeb1a3a08cc40e361ad296
SSDEEP

1536:s+19jzicgHeTVJikHkd8fdSha48T5Al2c04R7MHv98R7D+:59jzhT+4yha485AUc0Jl8RH+

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 2460	1816	rundll32.exe	88
PID 1816 wrote to memory of 2460	1816	rundll32.exe	88
PID 1816 wrote to memory of 2460	1816	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\asycfilt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\asycfilt.dll,#1
  2⤵
  PID:2460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads