a6eb7a7372c462b2e181014540491a062c540edc4ba0f65a9169cfbfb473e6c7 | Triage

Analysis

max time kernel
92s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 07:17

Sharing

Report Analysis Logs

General

Target

bin/usysdiag.dll
Size

376KB
MD5

4c5db6477ea151be370854b1346eeda0
SHA1

4234cc1bc932dd2ab7ee09b83dcf11f1caa87dfa
SHA256

b953561bb3f79136d51e3a23ee96615b68738d7409e034b8955eba6b671a5a3e
SHA512

4972a36b02f246cd132ff6b038604ca938b0a897dbe4222162c93d8f44e3b0fadd64552c2959953cdbbc6d05c0dd8c698a0c59d261d25e01066e74cca6825fde
SSDEEP

6144:l0/air/OzCSvvSCLmqD50P6oxtXYrQJZrGjfpr1ZQzKjJWSn:l0R/ORSg50ioxyEZIfpr1eGdWSn

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 4112	4292	rundll32.exe	86
PID 4292 wrote to memory of 4112	4292	rundll32.exe	86
PID 4292 wrote to memory of 4112	4292	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\usysdiag.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\usysdiag.dll,#1
  2⤵
  PID:4112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads