902576f7f90174513a45bc82796b82c9264a57c82c0c72b7c9bf11e7da6bba96 | Triage

Analysis

max time kernel
453s
max time network
455s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
01-04-2024 09:35

Sharing

Report Analysis Logs

General

Target

Plugin/plg.dll
Size

65KB
MD5

c179e212316f26ce9325a8d80d936666
SHA1

14d08b3cda60341d1e9187fc14bd64ebefe4a5b6
SHA256

13043521ed6876edf2736fc46a7c49e6b639cfa7a866ca11de26f119796cd521
SHA512

1b5eb687a9932c82ab2e655dbc5df8ba667a023e7568dbbd13c503a54661763193bde11937f87e2e09b88d770c8357eda07589d526e6103db058038e3ce3b750
SSDEEP

768:rVRKgRFKn3N5U2jNGUyXWI9Yi1s0sbtAEsz8CjBMiPs2T:pR3R895Npyhn1sBbtPsz8C9P

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 464 wrote to memory of 1448	464	rundll32.exe	rundll32.exe
PID 464 wrote to memory of 1448	464	rundll32.exe	rundll32.exe
PID 464 wrote to memory of 1448	464	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugin\plg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:464

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugin\plg.dll,#1
2⤵
PID:1448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...