2a74e566b9590e7225627b3c7a262162cb09077bc04c87347e40cd693c03718b | Triage

Analysis

max time kernel
140s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 20:07

Sharing

Report Analysis Logs

General

Target

$TEMP/glee.dll
Size

34KB
MD5

9efcdaec062823e9749250da225dfe4d
SHA1

1d6209a71c061729683ce81890f2d8c0c02c6e05
SHA256

04904de1d15bb931cf85eadb7714bd53f7236de0fbc1f62c22aafb3470ff847c
SHA512

b7faee0a4c769ee39fc11fe20c6ec362b6802e9fd7f81d8a495f1423263af8074cf995c1ff8d964680c10c3026e69ddb66e749b9b29784309502d805673a720a
SSDEEP

768:tyxfTX4H2MoxHO1iB94vJfIhdV2GLkBrNj2+QE8u8VP:sfTX4zo85w+pa+J8f

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4388 wrote to memory of 816	4388	rundll32.exe	rundll32.exe
PID 4388 wrote to memory of 816	4388	rundll32.exe	rundll32.exe
PID 4388 wrote to memory of 816	4388	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\glee.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\glee.dll,#1
  2⤵
  PID:816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads