10a4cb7a2790344ded0513b288d0431967a44706a345f50d1b8fec8e244793d9 | Triage

Analysis

max time kernel
143s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 20:16

Sharing

Report Analysis Logs

General

Target

libpng15-15.dll
Size

148KB
MD5

dd66b547317df67b094aa6001671ea63
SHA1

5a17c877895ca85ccc4a9410c971e9cd49c2e9bf
SHA256

44549afb8e6b71e1214e2d1ec2633165665ed3aa9c34592ce2245727c0f1f57f
SHA512

e7c2bf69ca99bd26c9abc2f551043aea6792c4a7aacb67fa84fd360fa73bd9af13be72e93d6e18eb26fcda5a16bf838891542a871e216fd2c54e9f2e923d0024
SSDEEP

3072:D5uzhHSEV4QZtJiTOrDJK4HcE+085F5gTv9unMCmUzx:9myEV4QyMJK4HtgFaTvUn

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 3348	4828	rundll32.exe	83
PID 4828 wrote to memory of 3348	4828	rundll32.exe	83
PID 4828 wrote to memory of 3348	4828	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libpng15-15.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libpng15-15.dll,#1
  2⤵
  PID:3348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads