6c2a40998028849e7f033918065886102be34e9674e17c7d9db6f3877bc85a9c | Triage

Analysis

max time kernel
315s
max time network
1604s
platform
windows10-1703_x64
resource
win10-20240404-de
resource tags

arch:x64arch:x86image:win10-20240404-delocale:de-deos:windows10-1703-x64systemwindows
submitted
25-04-2024 15:26

Sharing

Report Analysis Logs

General

Target

license/backupkey.dll
Size

10.5MB
MD5

4d5e157915e455cc18b2c3cbd0f8ce88
SHA1

7b33623c290ab2c26db25d7fdeebc9c1c710faa8
SHA256

514bb83e65b9124e1b3a99fd69b3f3d1bf1767a5351ad16286839bb305d1256e
SHA512

f7c27529a6d73bc2dbc9b699fe1283d30788f2f3a6546375c7144d789933503814350342fc9e8fa3b1f8c43b5563540658be35946aeae2c86b3034d941f5cfc1
SSDEEP

196608:2qqsnKH3AtgzhtQWzVlPsRwg1wRsTh6LdAMI4vvvvV:QMtgzhtZzVlPsRwg1wRCU

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3848 wrote to memory of 2260	3848	rundll32.exe	rundll32.exe
PID 3848 wrote to memory of 2260	3848	rundll32.exe	rundll32.exe
PID 3848 wrote to memory of 2260	3848	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\license\backupkey.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\license\backupkey.dll,#1
  2⤵
  PID:2260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads