cd7c3f2c5f79c619b75afa181ed0c7e7215025a8ea514a2680f8e30bb424aef8 | Triage

Analysis

max time kernel
142s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-03-2024 19:01

Sharing

Report Analysis Logs

General

Target

Notificacion/AsIO.dll
Size

120KB
MD5

3e2c867b129165acdb3a457e131b90bc
SHA1

f538fa5705229da2c4403830d8c9f13e3a885f73
SHA256

e1bb63ccac541b38266228acd3d77a141efc468a69c3f821bfcc06330ce86815
SHA512

8a6574138f43e263f045bf5b1f2b0fb495fb0d424c403a0fd5a19959bfc970243b43c46f4dff86091d34980d3be9bf07034d9f3478ac7043ef0bbf5e2ed365bf
SSDEEP

3072:mLCK0llptaTHfPwr5pm6Qi0ZqnPkNP97bLL:m+bllaborzQtzVbX

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4340 wrote to memory of 4320	4340	rundll32.exe	rundll32.exe
PID 4340 wrote to memory of 4320	4340	rundll32.exe	rundll32.exe
PID 4340 wrote to memory of 4320	4340	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Notificacion\AsIO.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4340

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Notificacion\AsIO.dll,#1
2⤵
PID:4320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads