2ba315ff4d5e4d85b85759fffad1152c3388a8e761c32dfde8c72fff1b96bfe5 | Triage

Resubmissions

17-04-2024 07:33

240417-jdvvtsae31 10

17-04-2024 06:33

240417-ha7jsahe7s 10

Analysis

max time kernel
147s
max time network
278s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 06:33

Sharing

Report Analysis Logs

General

Target

madexcept_.dll
Size

436KB
MD5

08c34e7491d9fa27ef9e70d6f31934a8
SHA1

d2a7084f7108717102831190370d5052b519a2a9
SHA256

df97c577196106abb67e56a05db22731db51fc8cc86b90c0dd4b16e43ae97ce7
SHA512

2ef1882c5b638aa6b2882c313624d493cc3b7493622af16e91a113720eca4f4f24e8e378e6fa07b210e86896751ea14505b892d5042202adfc3374cd8636264e
SSDEEP

6144:vlA649EKhEV30F8sl88nTjQ4Q50gEcW/jd+o72niVUNpa4/n2g:vl74ut30F8slzYlQcW/jd++2nJ7R2g

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2492	2284	rundll32.exe	85
PID 2284 wrote to memory of 2492	2284	rundll32.exe	85
PID 2284 wrote to memory of 2492	2284	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\madexcept_.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\madexcept_.dll,#1
  2⤵
  PID:2492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads