134c5d1acefee78416ad78742e402a3992bf3ab31ce21a7c3bf07cf4e182ef22 | Triage

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 16:11

Sharing

Report Analysis Logs

General

Target

Modules/Core.dll
Size

106KB
MD5

5dba34c734fa8ae37643f2aa6f600e10
SHA1

bc7cb8294245e18ce7558e4f75beb2de6ec1e0f0
SHA256

860c942dcb30abfe95c106e150c11f70544a1a6acb325ac2da4672f4a5f864cf
SHA512

4dd5d33b1cf741071cf496677c69785963bf069a5ccd59353adfaa103a09da29aee30d0fc043b480625e272e3f711b5bfac718098ac9c94f4ea19e68b6bd42d6
SSDEEP

3072:iZYCVPJG1+LWSYVgFWTNlOduuNa8I/+/VZM4vX0W8:iZYCflSSYSFuouuNa8I/+/VZM4vX6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 656	996	rundll32.exe	83
PID 996 wrote to memory of 656	996	rundll32.exe	83
PID 996 wrote to memory of 656	996	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Modules\Core.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Modules\Core.dll,#1
  2⤵
  PID:656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads