c486b3ea362c122d2ac9507a474f0df7eed2ebcd4db060a6a5f0ee25a51285bb | Triage

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 15:59

Sharing

Report Analysis Logs

General

Target

flui.dll
Size

1.5MB
MD5

c3a81902b947e14d936b756ca53bfab4
SHA1

256aa2834dc404b4d20d45b6c1ac16598b412d5c
SHA256

6602dfb02daa1163d3549bac2c67836282eb1cad3933b82d3cc706b34fcdc2bd
SHA512

61e99f9e5e2f5261f0a40d16ad0d623917d91dab998ade59f5c2c2c20799f335ea42ece7ca80a93e448c0f3d5fc1ed45c35cca932e58be70022381ffdf6d14a3
SSDEEP

49152:FeqWAmQrb3hg3Xaqh4vQh69v4Trd/QWNhJ+9bH0:YsX3hiX/h69G/8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 4784	4504	rundll32.exe	83
PID 4504 wrote to memory of 4784	4504	rundll32.exe	83
PID 4504 wrote to memory of 4784	4504	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\flui.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\flui.dll,#1
  2⤵
  PID:4784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads