fa09d24d7481dbdfc1cff6aaa92d2aec908e037a22a02346f6feeee5d6ba688e | Triage

Analysis

max time kernel
145s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
19-05-2024 15:21

Sharing

Report Analysis Logs

General

Target

Components/ssdp.dll
Size

31KB
MD5

80e53207d1f5f684b098bf70b66c34b1
SHA1

848367ff79a68319c9211abfae289a3802a809f6
SHA256

dd55372e906699c3e35f02313736f74a13d1e526d0b9620cadb70d57e530af63
SHA512

cd7e0b59a2eb0ccf164e958e758d53646dd6a229a67cb37e2d524fb36d19116117b7390a368bc47043faf407d788e839aee20f501b7c90d367515acdf65690ac
SSDEEP

768:mZsCH6rVPhn8cIdHbiGFCglWMEpYiTPx3//:mZRUVPh8cINbiGFCgq7TPxv/

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1464 wrote to memory of 3876	1464	rundll32.exe	rundll32.exe
PID 1464 wrote to memory of 3876	1464	rundll32.exe	rundll32.exe
PID 1464 wrote to memory of 3876	1464	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Components\ssdp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1464

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Components\ssdp.dll,#1
2⤵
PID:3876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads