615a74b5cc3d5e34ecfc07d05f025dd2e3bb627d0f14a5d2d53f47a3e1c82d90 | Triage

Analysis

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2024, 22:21

Sharing

Report Analysis Logs

General

Target

travedit.dll
Size

213KB
MD5

799b066426a3dda1086b051ac5bc3006
SHA1

c905cd11eeb15e25c48450a2ce1e5464c870788b
SHA256

24107ef91c777b7ce361f3fd570864d6257b3b9b3d992e46cdeb5c56873469cd
SHA512

289d99c2202306d302f29bc40bb8ac5ceaf70c399ca34a70a5f77401191f6bfde55b7e0e5baddb7bef6ece65fd7243dda73d9dda681502a84ae48124b314495a
SSDEEP

3072:c9fZ7xGnVpCOt/TYge70/b/igviHdSjAuiyxrGYuAQfO+UaC1:idxuCORYgWUv0sAuiyx3uk

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 4352	4168	rundll32.exe	86
PID 4168 wrote to memory of 4352	4168	rundll32.exe	86
PID 4168 wrote to memory of 4352	4168	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\travedit.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\travedit.dll,#1
  2⤵
  PID:4352

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads