afe04c513a6b177ec7b5203e68c50f277409d5e9b4c6fe540fd99b1a50095d8f | Triage

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 05:47

Sharing

Report Analysis Logs

General

Target

apprepapi.dll
Size

10KB
MD5

f443d481301a2dd1c7f14c2d913bffe6
SHA1

76c8c79c62fef3f08cd9de2f575875a7dcc6f478
SHA256

afe04c513a6b177ec7b5203e68c50f277409d5e9b4c6fe540fd99b1a50095d8f
SHA512

6a28bcbc890b09891439bc1304320906261128c1dd73ec78b0e5825e4fa3bfc8c02a9d4975964e03149fb4b8cd34788df4960b21494faea2c8f3927e0adca01d
SSDEEP

192:uFZTmhgFqfyBfTsiiqJNrjOXw+p7gL4EEkvaWn3WAPLpv:uF0xfsnjJNrjG5yL/vaWn3WAPLp

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 724 wrote to memory of 3812	724	rundll32.exe	83
PID 724 wrote to memory of 3812	724	rundll32.exe	83
PID 724 wrote to memory of 3812	724	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\apprepapi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\apprepapi.dll,#1
  2⤵
  PID:3812

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads