05a27e21a0194e0b5ac0af3fe1ba6f6aa6866e874ab2fd7126421139ffb80c59 | Triage

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 16:29

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/portable.dll
Size

24KB
MD5

c9397d267d0d10169c4535f6d5e06a6c
SHA1

2fc5d2e909d56042d32b3fe0a5ae39fc58d110ef
SHA256

25e5a428e663c6b6c352e7eb313d9fd265e944e0f8f88c7406c3fc15d1ad82b6
SHA512

143943d8e02392ef41c2c43641db9d1737a108defb9cd62a3ed3dce800ccbc8f5997f1d0ea4846ae675e3f2b0efbbd9cebd5c5c0022822d10a89a356983440e6
SSDEEP

48:q9aX7AL2vnYLtSFs4p3Wj4vLj4GWTQfQx2m28gF244m4y+bAghX:YaLArMpGjsjdTUt2t25m+

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 3980	4568	rundll32.exe	85
PID 4568 wrote to memory of 3980	4568	rundll32.exe	85
PID 4568 wrote to memory of 3980	4568	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\portable.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\portable.dll,#1
  2⤵
  PID:3980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads