e32d7f63e7d4feb47d830839301179631caf4c818b4b071306e4ee0a893438ea | Triage

Analysis

max time kernel
134s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 17:20

Sharing

Report Analysis Logs

General

Target

wake-synchotron-v1.0/bass.dll
Size

124KB
MD5

75c1d7a3bdf1a309c540b998901a35a7
SHA1

b06feeac73d496c435c66b9b7ff7514cbe768d84
SHA256

6303f205127c3b16d9cf1bdf4617c96109a03c5f2669341fbc0e1d37cd776b29
SHA512

8d2bbb7a7ad34529117c8d5a122f4daf38ea684aacd09d5ad0051fa41264f91fd5d86679a57913e5ada917f94a5ef693c39ebd8b465d7e69ef5d53ef941ad2ee
SSDEEP

3072:kdGUCKL7Wn/OzU2ThapTv773+HMnBasgGlBM:dn/mU8K/3EgNgoM

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 4636	3472	rundll32.exe	83
PID 3472 wrote to memory of 4636	3472	rundll32.exe	83
PID 3472 wrote to memory of 4636	3472	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\wake-synchotron-v1.0\bass.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\wake-synchotron-v1.0\bass.dll,#1
  2⤵
  PID:4636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4636-3-0x0000000000890000-0x0000000000891000-memory.dmp

Filesize
4KB

Download
memory/4636-1-0x0000000074B00000-0x0000000074B57000-memory.dmp

Filesize
348KB

Download