debe381f7f3647baab16c0926ccd86477a98588cbe2eb336665867f930d59628 | Triage

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 06:02

Sharing

Report Analysis Logs

General

Target

LockAppBroker.dll
Size

455KB
MD5

25f8b46103de47d861456ba98518f6f8
SHA1

327521649dac348704b2376d2f660550b94edd23
SHA256

debe381f7f3647baab16c0926ccd86477a98588cbe2eb336665867f930d59628
SHA512

3ec895b6405362927ba58705f1dee8af19d7ae2901e5ce1b54f2e98f46811b4140d80d99471a8f0631cec34b102e405fabafba26f97397af744fdc76e57c5820
SSDEEP

12288:PAGq36JuXs/gvYKYImz17K4cYLFc/PKj/8:PLOs/gvYfImBO4ceFc/PW/

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 3756	3212	rundll32.exe	83
PID 3212 wrote to memory of 3756	3212	rundll32.exe	83
PID 3212 wrote to memory of 3756	3212	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\LockAppBroker.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\LockAppBroker.dll,#1
  2⤵
  PID:3756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads