ea4b8c48a3e7917050c64c8224a397853acdf22603c8fbe3a9e8c14b25553463 | Triage

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15-04-2024 21:34

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/IEFunctions.dll
Size

7KB
MD5

5a3a8d916dd0071f16d217bbcfe7d047
SHA1

c2265fa5cec491706d0921e4274c674b693f326f
SHA256

465e81022be2df0433a6e02d427a79dc733031abc89d99746b73576a976857e3
SHA512

8908ee2e329171d2ee430aacf7f86be565472cdb9b338786188ab37d6e6a714e5bc98552a39737ff8a5f314730c9f351aa0f1fa8207eff32289d7bccb3e05a08
SSDEEP

96:GibIzePROHQWH6hhawoA8Blnw4npQhrfgWV6R6CtqLZ:GibcXvScwoAMlnw4npkroWV6RN4

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 4712	2800	rundll32.exe	88
PID 2800 wrote to memory of 4712	2800	rundll32.exe	88
PID 2800 wrote to memory of 4712	2800	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\IEFunctions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\IEFunctions.dll,#1
  2⤵
  PID:4712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads