5ac959e5dee9884512f4a34623bbad2c08be427669015b917a750f7cbfbb0a75 | Triage

Analysis

max time kernel
110s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15-04-2024 16:14

Sharing

Report Analysis Logs

General

Target

Plugins/CoreTemp.dll
Size

116KB
MD5

7ee5008e90570c5ffa8afe9ec0693070
SHA1

720117e3a3a4a0562e76dd5e91cecf1bc07846ac
SHA256

8aa49a2fe7cc2419d53f0fb68fe9c549e4b746e6919bcbb90f07842e3e7c2c8a
SHA512

bc9e7ff2de8fe38a32a77bcdccb2ab02b1986c4f07c20877e5f03a35d7323f87a6616f6dbe72b0413921defc4823968b4967b6361b289ad149058d531e7df040
SSDEEP

3072:3sHQOgc/AnrAm7ObimiRBLjhdMOWTKkI3t:VO6hw3irjjDWett

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 4236	4988	rundll32.exe	88
PID 4988 wrote to memory of 4236	4988	rundll32.exe	88
PID 4988 wrote to memory of 4236	4988	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\CoreTemp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\CoreTemp.dll,#1
  2⤵
  PID:4236

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads