ec4a958ab73fa233b4bb5cbaf68ea3486384997d53740bfa9c3307ce150a59dd | Triage

Analysis

max time kernel
89s
max time network
99s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
28-04-2024 10:49

Sharing

Report Analysis Logs

General

Target

workflow32.dll
Size

278KB
MD5

2a04eb59490a922e64ccb1329d845d76
SHA1

cadb4dff808defa4032e14bf5aa20626dc62ce34
SHA256

80658acd27f140389d597dec4b83232126b8a87fe59902d04c4708361c2f2d3c
SHA512

503053cae9a93658206d20502dc5ec255839b077bf27c2331bd2d2646c208d7ba83797a11114d69a448bada049618b05151586f7a58f012e4947fd2d505abee2
SSDEEP

6144:Fa8jU7RJqMPYLvv1MVP0L15xEe+2gsfTBRGqG1U:Fa8jU7Xmvv1MVP0rxEeR7F

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3384 wrote to memory of 3368	3384	rundll32.exe	rundll32.exe
PID 3384 wrote to memory of 3368	3384	rundll32.exe	rundll32.exe
PID 3384 wrote to memory of 3368	3384	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\workflow32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3384

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\workflow32.dll,#1
2⤵
PID:3368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads