a535a2972896469da575cfacf81589fa2386a82499d148214b563548368e8100 | Triage

Analysis

max time kernel
130s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 18:44

Sharing

Report Analysis Logs

General

Target

gspfxt2/XTRAS/DmPack2.dll
Size

67KB
MD5

c07879c01e8a9f500025ee1c96573605
SHA1

58a9e8a4c2740eb5677c8d4fc23acd019a46b251
SHA256

c9f6f2a2e74fde282b7dddf390865b1aa404913d6a52b8c18cc2ead8a5897395
SHA512

3615694ce59a995d6c58f2ce3ba43d2e13ef33970b8a94f25ad1d8e8bbe4d4580e9dfda2413ee63e1ae5f6ca137fd08c47ad8f46e8cbd70317aa991639c10c7f
SSDEEP

1536:QzSE9GgcVovH9iHp27zxXHGKJgbXmM+RW:QzSJgcVovdiHp27hDg6MG

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2928 wrote to memory of 2896	2928	rundll32.exe	rundll32.exe
PID 2928 wrote to memory of 2896	2928	rundll32.exe	rundll32.exe
PID 2928 wrote to memory of 2896	2928	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gspfxt2\XTRAS\DmPack2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2928

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gspfxt2\XTRAS\DmPack2.dll,#1
2⤵
PID:2896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...