8244d3c049d38b92198166cd4f16d6a77f67c731fd157683c25decf4e699867e | Triage

Analysis

max time kernel
133s
max time network
277s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
16/04/2024, 19:36

Sharing

Report Analysis Logs

General

Target

mojo_core.dll
Size

1.3MB
MD5

8c073f670b71394b922422cb3ea3a0a3
SHA1

9d57232681a0bc269a67242c9e3f8545caf726ce
SHA256

9b2c0fda0b9802dfba296f8e594ef48b9d030bf1a2b1d47c0020b3f64e8c9287
SHA512

51188e3507a4f70d048e60cfb0380b72f26538b6327d99897a5d08c15a13ad6f07d65ec07444c098695f67bdae175cde80a9557bcb47c6a680b6b83eee2e043f
SSDEEP

24576:Sy5k9j5NPK7Qg4q/asgCeeI1wIOPuHzDV11AVS8UHNSWv:C9j/PK14qisgIIrOPuH/V11U8SWv

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 1308	2564	rundll32.exe	79
PID 2564 wrote to memory of 1308	2564	rundll32.exe	79
PID 2564 wrote to memory of 1308	2564	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mojo_core.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\mojo_core.dll,#1
  2⤵
  PID:1308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads