df5b4f8f0a459bb640a2a42028d9c9afd048d136ae98583d4040b01b07260167 | Triage

Analysis

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 01:41

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/StartMenu.dll
Size

7KB
MD5

a22f252c71eb36627fdb4cb0ef72eadf
SHA1

ddd8e4f52ebd6b72d03699dc612100bc8b9f5e19
SHA256

45f3afdf22da380bee78de92740e1e08050d03c74566ef886856a2266395fd6f
SHA512

00ff3ad2fcdaba9919b63d1252421f3d4077669f74a1629e816682fb5b460e14e2ededc6b6aefbc980f1133b2b01dfa172bc356aea4a98d966e5da9c423bb595
SSDEEP

96:DLzRnV/YfgGJ01uBgMkW0Shlif3YhGrPjsF6GjUoZ:DLz5BGJ0KdrifIessGjUo

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3644 wrote to memory of 1360	3644	rundll32.exe	rundll32.exe
PID 3644 wrote to memory of 1360	3644	rundll32.exe	rundll32.exe
PID 3644 wrote to memory of 1360	3644	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3644

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
2⤵
PID:1360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...