4823257b6e91618705a5f1459308365cd3392d2a5e9164e0318a5eee7173d717 | Triage

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22-04-2024 01:17

Sharing

Report Analysis Logs

General

Target

LibSearchFileName.dll
Size

53KB
MD5

4e11d94605103f95502272ff8bb23585
SHA1

c499f946356dab50be7c8b4cdb82556a0fdf517b
SHA256

297c983876494833139ad2c400f5d69ad8a2238a4356e726f6e143d4e04f435e
SHA512

aedffac32606b8fb221b31d457c240495c5c1344aeb09a8e9699d48510586144efa5283e10305a520e78593431ca40247786695d54baa63d11fc4dc8d83b1d74
SSDEEP

768:rttOSW6gvM3QYvPCyyWoXyDw3mF4Y2yEFQhx0S+3/A8PZZN:rLOJwPSyBK2F4pOx+3/RBn

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1768 wrote to memory of 1836	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 1836	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 1836	1768	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\LibSearchFileName.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\LibSearchFileName.dll,#1
  2⤵
  PID:1836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads