9b587f0574d013ada38f6973195e0ebcb1889952370dd3396e9f89e3622ff81a | Triage

Analysis

max time kernel
150s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22-04-2024 01:43

Sharing

Report Analysis Logs

General

Target

NtfsOperate.dll
Size

142KB
MD5

e6d5742291a6352b9bbbaeae21a78837
SHA1

b8e6485ae24bcfa700bd463bcc05c3ecdd044b6b
SHA256

6c0d6233d8c0074a5084e8d12148e90c72cbb8c0bbef917067e9f2547fc9c83d
SHA512

999a6192cfe940c568202594eed64e636190c15c86e38ca97f541907c790492516beb8b33ec9851d62802cfc71d1c06ed04f7fb8dbc7876e3d828afeb04f1157
SSDEEP

3072:mtQul439NZiYd88+HS7SPlSUmoB7pInBGhBi:mtQul+NZiY97SPlT1iGG

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5372 wrote to memory of 5592	5372	rundll32.exe	rundll32.exe
PID 5372 wrote to memory of 5592	5372	rundll32.exe	rundll32.exe
PID 5372 wrote to memory of 5592	5372	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NtfsOperate.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5372

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NtfsOperate.dll,#1
2⤵
PID:5592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5592-0-0x0000000001100000-0x0000000001129000-memory.dmp

Filesize
164KB

Download
memory/5592-1-0x00000000013C0000-0x00000000013D6000-memory.dmp

Filesize
88KB

Download