0b18ba0573f449ecb8b796c4496b14e94ae745dccfb7568545be7dace8489a6c | Triage

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 00:13

Sharing

Report Analysis Logs

General

Target

components/foo_dop.dll
Size

265KB
MD5

31fdf6a47af9e90f17b4d4313a6d9eac
SHA1

c1a97fb688dd47c6bded150823afa39e13e719da
SHA256

daef386f50b0a7775a44eb22a9db321a674e3651d07e034740b94972575d7f2a
SHA512

358ffa609b776fc754c9027d23882cca06ea3540df245e480f4848a652dac735147f3dfab4c07e06eb9a55db25ab8463d388d9aa6e82eedc9ee8a53af318eb44
SSDEEP

6144:R5hBcz3+wJvCnThYTmkguRgMIhAOpuxZDpwS:7mSYTauvSov

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 1020	3152	rundll32.exe	84
PID 3152 wrote to memory of 1020	3152	rundll32.exe	84
PID 3152 wrote to memory of 1020	3152	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\components\foo_dop.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\components\foo_dop.dll,#1
  2⤵
  PID:1020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1020-0-0x0000000010000000-0x0000000010048000-memory.dmp

Filesize
288KB

Download