c4079adbd900f429976e7363d635dca803e7d244675263ebb30b1ea8fc889e29 | Triage

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 23:30

Sharing

Report Analysis Logs

General

Target

GGLanguage_Pub.dll
Size

179KB
MD5

4d40effb2c7b14da87c6a13f5798fe9c
SHA1

464801df58d151086a85b2ba97e62d9c9fc4a803
SHA256

22a6ef8d24b59c5d9b6468dfa820078575e461a4929b6b1df745ddac2bed3095
SHA512

1ecbb19439203767572a6d7e7ac4d5f28620b76cebcf527c6a61e6c06d0641e98b93a2c0d2a07338e786da60b35e794eb7cf8f90ffc2f13bf9ca2c40ac5bed2b
SSDEEP

1536:BYRgv2bReTx7p5mqt64gZDDjR2rc/xvVfUw2vcyq:Lv227nDtt+DDtcc/xvVf8cyq

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 4284	3088	rundll32.exe	81
PID 3088 wrote to memory of 4284	3088	rundll32.exe	81
PID 3088 wrote to memory of 4284	3088	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GGLanguage_Pub.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\GGLanguage_Pub.dll,#1
  2⤵
  PID:4284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads