80d28b14d2172c2a3a76a718b604d120ff2a8e80424d68790afbe0bd267ee064 | Triage

Analysis

max time kernel
136s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
06-05-2024 03:13

Sharing

Report Analysis Logs

General

Target

ATL80.dll
Size

95KB
MD5

3e9a33113d663d8bd5ed38858e669652
SHA1

1292dc7ffc35a1ef2b761672361bcffa7483169e
SHA256

63e1985a37d5993d170373bc28d067c13c1541ca2b63968b82e35eaacd927b49
SHA512

a2dcd0d5db662653d3085d2ab39e8697b25e096fd2093e3f5ca2edb3087356814adb9f99e490dc95293198e05551a3ddbb3fa2918b8ed5f76d84a22268bfbe7a
SSDEEP

1536:SskNTnYQzkuvliN+9sdYhfv3rkT+za16/rWmE9dV87mKxGXmwkbos3co9:S1TnY4kclz9sdO/o9dVMmXmwkl

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1832 wrote to memory of 4736	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 4736	1832	rundll32.exe	rundll32.exe
PID 1832 wrote to memory of 4736	1832	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ATL80.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1832

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ATL80.dll,#1
2⤵
PID:4736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...