961bf55f25103eeb23ae7f6d25ea26f57eb23ebd521ef5c7397f50aeac37ac8d | Triage

Analysis

max time kernel
139s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 20:04

Sharing

Report Analysis Logs

General

Target

ImageConversion.dll
Size

196KB
MD5

18a95233a49fb06e0d7d29e396c65f7d
SHA1

ac9ca3e837e4c4b07f28b5e8a1ff55d6bc853b56
SHA256

b8196f6e55bebc9368fde1743db5251f756ab32b66e67628449bc042042caed8
SHA512

ab7d9a71f895329035a73b9e5e8cdc92e188eb90630e5016dc34a66ff16ddeef548b0326792a96d9116fcf219368a9d1b95ee65afefcd772c55d943177398669
SSDEEP

3072:mEad4E4Ik6UU1caVFn2krQ2ZOEIQTBfbAg0Fu125/cgJ:mEaLkQtVFn2cJZxIQTBDAO0z

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 3600	1004	rundll32.exe	86
PID 1004 wrote to memory of 3600	1004	rundll32.exe	86
PID 1004 wrote to memory of 3600	1004	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ImageConversion.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ImageConversion.dll,#1
  2⤵
  PID:3600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads