b8cb661ff6b8dd7be850a9ac2594a6bec1ad468316a8254470ff062112b64910 | Triage

Analysis

max time kernel
1477s
max time network
1492s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
22-03-2024 06:02

Sharing

Report Analysis Logs

General

Target

Geode.dll
Size

6.7MB
MD5

3df3962ef7974ef65e4ebb87aaf31ba7
SHA1

8b3100cc6b7a1a5af347e1ccf3e0f0f0a283065d
SHA256

a0c25fec042a599201d591bc9c61a14566e760ae4b54c82ccf3c671881e1a219
SHA512

d2df79d60775b62ad107dacb27418711b6e9e4d1cb3e217f5f3dbe986e685eb73817aba6bd92ac514441492b628161c69452f75272871d5f747a5b8c035b9966
SSDEEP

49152:avD8JWK3Cg5i8dLvafx5JBScwiGCFkaAguUvMiQ02PlC0Jdt3Pvvcs64WnJ:Vtd5tQx5J1wieguU60OlLdt

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3060 wrote to memory of 3756	3060	rundll32.exe	rundll32.exe
PID 3060 wrote to memory of 3756	3060	rundll32.exe	rundll32.exe
PID 3060 wrote to memory of 3756	3060	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Geode.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3060

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Geode.dll,#1
2⤵
PID:3756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads