05a27e21a0194e0b5ac0af3fe1ba6f6aa6866e874ab2fd7126421139ffb80c59 | Triage

Analysis

max time kernel
133s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 16:29

Sharing

Report Analysis Logs

General

Target

Plugins/DiracLE.dll
Size

268KB
MD5

93238672c08442d0fa2f41923e2c51cd
SHA1

98f97cbc1747a02d00116123425c45fbd86be531
SHA256

bb61ed1bf7e2b98e040c20936523bd9bd71ea2b546d6fa95ed51f1541a8910b8
SHA512

e013e3a7a25d1ccac6a4abd4980cb9e6a3f0637d7e3712d5a20e86841a338adde350a170aae978d8aec06d6764d5c018a8feb94f09e035b658f9a1b0683cb686
SSDEEP

3072:ZDkQ3hnmg5lalIXt6Wbtz+nFdor2gUbbzsl49oa/p:Z5Xt6qwFdor2gUbbzslo

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3420 wrote to memory of 3564	3420	rundll32.exe	85
PID 3420 wrote to memory of 3564	3420	rundll32.exe	85
PID 3420 wrote to memory of 3564	3420	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\DiracLE.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\DiracLE.dll,#1
  2⤵
  PID:3564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads