e72826c3dbd6781eaa34b9ec33e276f6d811c36c3a6ced9ae95e67fbf1c7cf8c | Triage

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15-04-2024 17:35

Sharing

Report Analysis Logs

General

Target

wjpjk/Support/asycfilt.dll
Size

144KB
MD5

9f81f05a9a9c7b94790e4bebe2feb112
SHA1

0e9e7d035ce7d23b341c72d0287568b970e1e47b
SHA256

5ee35e51cc4eae26d84fbb3419cc74b11d1108802427f861a7e3dd2a09a48412
SHA512

31769dde653ffc6ad9bf58e2dd9b6aba2b3510ea08d67fa758d099c244249a31b433b2f3b859e673bad87c0613254c744d336394b05d5e87d5865a85813d727c
SSDEEP

3072:cQNxaJt42UMPls65T9CCL7FwiHIakbg9nqEz:NNxaJt2i1hCCLZHw8n5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 1428	3552	rundll32.exe	85
PID 3552 wrote to memory of 1428	3552	rundll32.exe	85
PID 3552 wrote to memory of 1428	3552	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\wjpjk\Support\asycfilt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\wjpjk\Support\asycfilt.dll,#1
  2⤵
  PID:1428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads