c37ac379f7614de0382c60dee8470067c15397a0679cff1f6e4b7f6b40f029b6 | Triage

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 18:08

Sharing

Report Analysis Logs

General

Target

GomVR.dll
Size

225KB
MD5

39b2b639ea38fc5af16729e32c25255f
SHA1

041d9e62e4224ab45e1ebe40f12249c7bc138db2
SHA256

f0ac5c963159905486fab58fb340ae6694a4154bb06fa088ef055f9d25ce9e2b
SHA512

a39054918343cc903ada272c7bd38adad00563feb6a45ead23f157e7db85fc1c9d169fc0596b638be2dd08bd14c43948390e4a3a3b2fcc5bd21a2f582a85e1e6
SSDEEP

3072:oWK0YC1ZFbd5vwyRUshkZIZpINQLyKpncLCQ/tSVCXQfkg2RJlTR0u7N:oWK0/dRwyeshkZSpIGe7Rs7fkg2bc

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 1056	5020	rundll32.exe	84
PID 5020 wrote to memory of 1056	5020	rundll32.exe	84
PID 5020 wrote to memory of 1056	5020	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GomVR.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\GomVR.dll,#1
  2⤵
  PID:1056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads