74fbb80e9ce946d112bc393e5734ac2aa5d24ab02402140f7a817fba4aab9727 | Triage

Analysis

max time kernel
92s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2024 17:59

Sharing

Report Analysis Logs

General

Target

$TEMP/gazumps.dll
Size

6KB
MD5

f61e1bbe20b14c5f1baf9192916f3fbc
SHA1

ed5f29f943dfcdee8894077f408478e5313ae4b4
SHA256

74dc1203f77e1b7e352e13c49bd3d71a9d32ff5511e03f6c9b49f11424e2ca59
SHA512

d16ab93488dad2f6d98f566562dae76c21e1ff31ec8f65991792d77ebb8d690bda458c304feffb83d6dbaa7bd5829529b9a7fe77e10211c4aaf61d63e978b2f3
SSDEEP

96:hNRubDG4qteK8I9xkR8MglDKPis8LgrDEy42KkpWh:J4Df3Kh9xkGluPi9LIDE2rW

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4324 wrote to memory of 2476	4324	rundll32.exe	rundll32.exe
PID 4324 wrote to memory of 2476	4324	rundll32.exe	rundll32.exe
PID 4324 wrote to memory of 2476	4324	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\gazumps.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4324

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\gazumps.dll,#1
2⤵
PID:2476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...