750c447d6e3c7d74ccab736a0082ef437b1cd2000d761d3aff2b73227457b29c | Triage

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 11:54

Sharing

Report Analysis Logs

General

Target

libgthread-2.0-0.dll
Size

43KB
MD5

7ad6f303082b382bff7bafbab246c61f
SHA1

8d94c4d4b0633a80e28504a3c694dd2bae252854
SHA256

ee2e8485fdbfb2c5626099ccafcdc41ac60414dffd5c6c3befaf786634baf5c3
SHA512

eee840f217ff65b22efd16e78fb898990116efdfb6ee1cbf9d9fb64b9f3209f18860f6477c1df60352fb242671d973dcac043134748f823d210fc393ed4e2598
SSDEEP

768:OwrBdO1XBfXbbeHFolT8EiH8PWVLCfn7Hve2f3vSEWLxUswVwn:700Ojv1vwL7

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4524 wrote to memory of 1128	4524	rundll32.exe	rundll32.exe
PID 4524 wrote to memory of 1128	4524	rundll32.exe	rundll32.exe
PID 4524 wrote to memory of 1128	4524	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libgthread-2.0-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4524

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libgthread-2.0-0.dll,#1
2⤵
PID:1128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads