a6eb7a7372c462b2e181014540491a062c540edc4ba0f65a9169cfbfb473e6c7 | Triage

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 07:17

Sharing

Report Analysis Logs

General

Target

bin/behavior.dll
Size

245KB
MD5

cf5d7b176a13b35e03eb290ba9dbe48f
SHA1

1ac8472d1c0451ef06e77e22698e8a67033c99dd
SHA256

a568ed9abc1cacd846bea4f741d87aa4843fef76c168d3d94c890ee89b2fd65f
SHA512

3da5bac4c209eaf04f1cc9709602a6117c8d9602c06073180d94ed7b6469ca18ae2b731a0076b33dc5330b142e24680d3eda36ebba4da075384ead009c98c897
SSDEEP

6144:zWg4taTsyJTOPetiM6FdhrUSBhuL/YDCCCCCCCCCTxEK:J4tMsyJeetiDHrUSBYT7CCCCCCCCTxEK

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3544 wrote to memory of 2732	3544	rundll32.exe	86
PID 3544 wrote to memory of 2732	3544	rundll32.exe	86
PID 3544 wrote to memory of 2732	3544	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\behavior.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\behavior.dll,#1
  2⤵
  PID:2732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads