6c2a40998028849e7f033918065886102be34e9674e17c7d9db6f3877bc85a9c | Triage

Analysis

max time kernel
314s
max time network
1584s
platform
windows10-1703_x64
resource
win10-20240404-de
resource tags

arch:x64arch:x86image:win10-20240404-delocale:de-deos:windows10-1703-x64systemwindows
submitted
25-04-2024 15:26

Sharing

Report Analysis Logs

General

Target

platforms/win32.dll
Size

123KB
MD5

5d25e492836df0ae8b869ef9077f1ca8
SHA1

68a50b52caaa89ba04f2f6617c9c3bf18e7f8ac1
SHA256

c05047a341742504f8312a0b274c19fbdcf0bfd37f76ae2277491ab8b2297a5c
SHA512

fc107e0b95ca7095f0fcc94d26ed1ffbc9bce74063edc8f12104e68b52da6c73b8d72c1cdb81535a135ac849ccef5fd69a2004fa2ecf6dd41a0f8658f2bd6830
SSDEEP

3072:YfLOXurSBlfHfG2N1X5S4RvSCzdPV0VXkjf5l:aElt3SsDdPVLjf5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 228 wrote to memory of 4296	228	rundll32.exe	rundll32.exe
PID 228 wrote to memory of 4296	228	rundll32.exe	rundll32.exe
PID 228 wrote to memory of 4296	228	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\platforms\win32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\platforms\win32.dll,#1
  2⤵
  PID:4296

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads