0fb2c764a02c108131864404335b69eafb87d6987247941a65fa541ecf3da602 | Triage

Analysis

max time kernel
139s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 05:40

Sharing

Report Analysis Logs

General

Target

SimCfg.dll
Size

81KB
MD5

0f500f392c9df9784a9a9e341682fc24
SHA1

57e39205395897055e37c53e2bf9cae40c847d10
SHA256

0fb2c764a02c108131864404335b69eafb87d6987247941a65fa541ecf3da602
SHA512

569092e01afcbdc84167f220483fea24cdb27412be6a1b51f01c9a3a8a54e412db7adafba3113bff679b36fca8c6836401531a530c689adbb8925932ebe59700
SSDEEP

1536:2+9XV58lGKYUU03SmdJAcr0pViWNMWnzRacC+D2ixnvo:2+9XVeA7qfAcoDXN1nzRacCc2onQ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3728 wrote to memory of 3372	3728	rundll32.exe	82
PID 3728 wrote to memory of 3372	3728	rundll32.exe	82
PID 3728 wrote to memory of 3372	3728	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SimCfg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SimCfg.dll,#1
  2⤵
  PID:3372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads