750c447d6e3c7d74ccab736a0082ef437b1cd2000d761d3aff2b73227457b29c | Triage

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 11:54

Sharing

Report Analysis Logs

General

Target

bass.dll
Size

126KB
MD5

d697cef8a405bddd95ad05d97e997b16
SHA1

971cef29794c10b874e82e267237189bb680bb42
SHA256

5c39202c34a55ad6b75914b2b9db5281fd9b5a7c61d5399a2527f37106b115e8
SHA512

54dbf28bf47e2732ddfdcc48efcb8b92a52d86ba4b38c0943554bc0e631edf76e4a35d67f472e4ef8b2ae6b6949dac51998e27bcb4fdd374b0145126654f0b72
SSDEEP

3072:8wbizLcb+pGOo7H07h4FaNXLeoszGre+bv8CIcBPkn0tm6t/2Ak4ggf:8Ki/cbnj0h73szGBXIVn0tX/HNr

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 100 wrote to memory of 4848	100	rundll32.exe	rundll32.exe
PID 100 wrote to memory of 4848	100	rundll32.exe	rundll32.exe
PID 100 wrote to memory of 4848	100	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bass.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:100

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bass.dll,#1
2⤵
PID:4848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4848-0-0x0000000075220000-0x0000000075278000-memory.dmp

Filesize
352KB

Download
memory/4848-3-0x0000000001210000-0x000000000122C000-memory.dmp

Filesize
112KB

Download