f4665a7274e113691256ab2e8d894098a5861558492ad71ee76544d029a172c1 | Triage

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 22:54

Sharing

Report Analysis Logs

General

Target

IvsDrawer.dll
Size

120KB
MD5

8378c11d8ceaebc3fd22e4ddaa07c0bf
SHA1

882532c86c99f32a9a7b64da8789e80681ac32a6
SHA256

ad9702a9bea5a4cbb20997c872fb2b40dba0f11eabdfab49882271ed37bec001
SHA512

0d2aad077736b2da16ab205b77dc50b4fecace4f60a13cc489cfa29857540e05a2aa45216b84f720a7f78f0d258aadc61e64a83aba4fd3ffcc4da98c10507b36
SSDEEP

3072:7Illc7xPBIbStYdNMfGupHf8xXJ4u07Lc6TGXENBDaiNy:cTGOGBkf+/TG0Daqy

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4856 wrote to memory of 2540	4856	rundll32.exe	rundll32.exe
PID 4856 wrote to memory of 2540	4856	rundll32.exe	rundll32.exe
PID 4856 wrote to memory of 2540	4856	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\IvsDrawer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4856

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\IvsDrawer.dll,#1
2⤵
PID:2540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...