2769155d033b0441b80165f00a126db615ba18046ae0a952c9d145ee4ce1b0ae | Triage

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 07:23

Sharing

Report Analysis Logs

General

Target

$TEMP/ShoonCataclysm.dll
Size

48KB
MD5

6864b4b87cb50d998f8c3d583e0e5bf3
SHA1

c90c3de34d735e40a81e42254f60453ac8cff190
SHA256

178b978482f6ede2219513d9dbbce2df3d09e188114a8eb4caca7d4390c03f17
SHA512

2db7f163c3364fdb2e06e8c67062f2fdcf243358fe9d156e3da0ccac3876e75e4870450e20cd46e67b1ce32ee59231e81ef7ccf0c6af432d4061c93667e4feba
SSDEEP

768:1/4Clb6KhYKJbfJF61tthuLjpJ1x57019+6J6HTTDWm7bQhudae5:J4yDwtqjpnq7JSTn

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 1108	3128	rundll32.exe	86
PID 3128 wrote to memory of 1108	3128	rundll32.exe	86
PID 3128 wrote to memory of 1108	3128	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\ShoonCataclysm.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\ShoonCataclysm.dll,#1
  2⤵
  PID:1108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads