a535a2972896469da575cfacf81589fa2386a82499d148214b563548368e8100 | Triage

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 18:44

Sharing

Report Analysis Logs

General

Target

gspfxt2/XTRAS/ACTIVEX.dll
Size

160KB
MD5

dcac25a9ce0d423dca65cdea97aad93a
SHA1

8518f75bc9dc94383c456532d5d62e50d57bcf74
SHA256

dcd997561df4ea290def83ba186989800e6fd3af6fe6626106e35091e0b605b4
SHA512

51b3383d765742136c905e593893293c225a382fa1d97ae3461e0563ea1a6ad06f977a05ca3fb3391fbdfbee07c4c4172ac95e3abd901da6bb65ad439978f5f3
SSDEEP

3072:pmpinJy5DfucbO7m4aRQLeSacCAilOP4DUou9hbkyt:FnmDfdbO7m4aRQscZiEKu9v

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1656 wrote to memory of 1416	1656	rundll32.exe	rundll32.exe
PID 1656 wrote to memory of 1416	1656	rundll32.exe	rundll32.exe
PID 1656 wrote to memory of 1416	1656	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gspfxt2\XTRAS\ACTIVEX.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1656

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gspfxt2\XTRAS\ACTIVEX.dll,#1
2⤵
PID:1416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...