0bb7e3c0492d977fe3b32844b0bccec70a808c2f7a2e36ab0942ed8101d54783 | Triage

Analysis

max time kernel
136s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 05:11

Sharing

Report Analysis Logs

General

Target

libpng1.dll
Size

92KB
MD5

eeeedbc3d2e133461b8d13c508ab3133
SHA1

f21e3b9a3a87d54177be593a13cf41e074cc55d5
SHA256

286c2e5383ce3236051f3f4e9007cd979f8677c5bfe21368718e26c8d77b5137
SHA512

9cadc4a9f2d07d250c1898e99f24347a31df09cfcc8e0b66a23d8139edcca112a8125802a5526b990613ac2bb57ec8dfa1f219c7a3abe5e1ddf66e92fcc87c62
SSDEEP

1536:koIx2Vq2jEaTvE4lGP7l7oeeiNES2zMTkYjQ+:koxNTPlGP7l0eeiNERII8Q+

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4524 wrote to memory of 1248	4524	rundll32.exe	rundll32.exe
PID 4524 wrote to memory of 1248	4524	rundll32.exe	rundll32.exe
PID 4524 wrote to memory of 1248	4524	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libpng1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libpng1.dll,#1
  2⤵
  PID:1248

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1248-0-0x0000000002D00000-0x0000000002D11000-memory.dmp

Filesize
68KB

Download
memory/1248-1-0x0000000002D20000-0x0000000002D47000-memory.dmp

Filesize
156KB

Download