c8f5ca7f0c01ce9d967a6895d13402e2299fc62e8b94dee27b20e66f13cb1f4c | Triage

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 23:01

Sharing

Report Analysis Logs

General

Target

coreshell.dll
Size

396KB
MD5

c1cd8f640dc560e9bdc873282298623e
SHA1

f1e318c4250ac14ab49efdeea7856f949d68aa1e
SHA256

c8f5ca7f0c01ce9d967a6895d13402e2299fc62e8b94dee27b20e66f13cb1f4c
SHA512

c991a75199821430cf0a83cba87323dc8e8151d5147cad5bda7ac12259dcbf75320721fc84ed7bb9ccf5128dbdefa235ed1d768311436216aae55595cf121fb1
SSDEEP

1536:/CwxSsJ5ucqow+cdl4ScsWjcdIjVuyjCgAV:/CwxSkvGl1IjVuyOgAV

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

2000 rundll32.exe
2000 rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3580 wrote to memory of 2000	3580	rundll32.exe	rundll32.exe
PID 3580 wrote to memory of 2000	3580	rundll32.exe	rundll32.exe
PID 3580 wrote to memory of 2000	3580	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\coreshell.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3580

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\coreshell.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads