2ba315ff4d5e4d85b85759fffad1152c3388a8e761c32dfde8c72fff1b96bfe5 | Triage

Resubmissions

17-04-2024 07:33

240417-jdvvtsae31 10

17-04-2024 06:33

240417-ha7jsahe7s 10

Analysis

max time kernel
147s
max time network
275s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 06:33

Sharing

Report Analysis Logs

General

Target

maddisAsm_.dll
Size

63KB
MD5

ef3b47b2ea3884914c13c778ff29eb5b
SHA1

dc2b1fa7c7547d8f1ad3f20f9060f7bc686118e0
SHA256

475f7cdffd8ed4d6f52bd98ae2bb684f1c923a1be2a692757a9af788a39b1d87
SHA512

9648d951d8d3640436c8029fd0f06786f7ff8f52191cd6959569c87868bb6c40ac8c7e495c09377a8a5c85e8d3942551c37eb84e916b5c16327d8d43a167820e
SSDEEP

1536:eNy3eqMne0sXB0IWtCLwEJhY0w1K7fixStj7wyis:CqMnfIB04LwEJhY0w1K7zzj

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 5004	2136	rundll32.exe	84
PID 2136 wrote to memory of 5004	2136	rundll32.exe	84
PID 2136 wrote to memory of 5004	2136	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\maddisAsm_.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\maddisAsm_.dll,#1
  2⤵
  PID:5004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads