5ac959e5dee9884512f4a34623bbad2c08be427669015b917a750f7cbfbb0a75 | Triage

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 16:14

Sharing

Report Analysis Logs

General

Target

Plugins/iTunesPlugin.dll
Size

120KB
MD5

b9214d664da613530894bc8bbdb5f6ed
SHA1

0d73953733eace553aa38a4af012ce78128493b8
SHA256

834072095ffc4b746f894c07429d8b24084d132726b947fcd0f545db2ea2bfb0
SHA512

e59e5508466757201a7f04ecac53548af39af37f819f352d0e1633903aaf4f1b4e5965f25608bf8ab9b9180a500d70797655597e090ef0b7af15a661f390a9be
SSDEEP

3072:CYRLsF8zro1ebDaRXYRQjByBDCiNyIqGE:RLq4W9YaBUDCaeG

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 1008	1228	rundll32.exe	86
PID 1228 wrote to memory of 1008	1228	rundll32.exe	86
PID 1228 wrote to memory of 1008	1228	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\iTunesPlugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\iTunesPlugin.dll,#1
  2⤵
  PID:1008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads