80d28b14d2172c2a3a76a718b604d120ff2a8e80424d68790afbe0bd267ee064 | Triage

Analysis

max time kernel
134s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
06-05-2024 03:13

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/ProcDll.dll
Size

1000KB
MD5

889686a649b80f6025f246ea6e778021
SHA1

4ca2cb0117dd6fd63dc197707970efb19144ed56
SHA256

8a0ebf941c15a69c9a7978aa8b17700dbcf0790768c372cbb16cc8e64611b54d
SHA512

ea78a522e046166666989f7b41cce14cc96ea0156277ffe45c77b5190ad90236e107f725e063552177bb5225f4cbef064363256a7e90e58d617e8653e1a9bf2f
SSDEEP

24576:gbyR6M5YFefN/9kA7ewYbsPW/YfR/ad4:gWxyI1CwfR/ad4

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1416 wrote to memory of 4500	1416	rundll32.exe	rundll32.exe
PID 1416 wrote to memory of 4500	1416	rundll32.exe	rundll32.exe
PID 1416 wrote to memory of 4500	1416	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ProcDll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1416

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ProcDll.dll,#1
2⤵
PID:4500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...