b75ff60aaccd7c025a5a2d27afc266bf23808cf46840a4bc868859f0902e09a8 | Triage

Analysis

max time kernel
146s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 15:27

Sharing

Report Analysis Logs

General

Target

TwistedBrush/_ISEffects30.dll
Size

248KB
MD5

f9875cb7fc85dcaa061283a7705bd527
SHA1

1c612baf271410ca79b0034109fb4c5203cb37e1
SHA256

6cbf2ca8e6cd33091a50136631e1f548f012700bb53fd6a3732314e1d63ff7e5
SHA512

3a4c7f3c4dc4a8dd60adbf79d4327030036fa2c08795e65d19f6219b179adf3c3ba3815718a0ed0a92cde1c57a9e774f17627289b7ec09e7f4c4daf97268c6d4
SSDEEP

6144:O98nD5VhNKBZWbAwbxx2dThooTR1a4n6:OgjfTbjbxodTmCTVn

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 4948	4728	rundll32.exe	89
PID 4728 wrote to memory of 4948	4728	rundll32.exe	89
PID 4728 wrote to memory of 4948	4728	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\TwistedBrush\_ISEffects30.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\TwistedBrush\_ISEffects30.dll,#1
  2⤵
  PID:4948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads