10a4cb7a2790344ded0513b288d0431967a44706a345f50d1b8fec8e244793d9 | Triage

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 20:16

Sharing

Report Analysis Logs

General

Target

libfreetype-6.dll
Size

451KB
MD5

69ecc2d6fc9158d9076eff16c85e1c66
SHA1

c76719103e395e928bb047bc45f780942e339c9d
SHA256

1bb7699c47f85b9ff43bab71b989a5d50da83c9204daae1108659fb0efd142f0
SHA512

bdce4bfb9dc7abac08b142ede4a82368606b3d7ccb715535b2c997e8826aa91cbc8131ef2baff7baf19d0d08463173c5373e508f5d9562ece439d05675a2d8ee
SSDEEP

6144:1yJduX41qkZCVNGdZZrI2q57e/lGOYZBZMSup1GBUyDwRCuWsEWmfD:UJO48KIzdeUOYBMhMBUoafEWm

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 3608	3236	rundll32.exe	83
PID 3236 wrote to memory of 3608	3236	rundll32.exe	83
PID 3236 wrote to memory of 3608	3236	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libfreetype-6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libfreetype-6.dll,#1
  2⤵
  PID:3608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads