d451f6bc38ae71eccde50310507a91527714d64bec4aa4cdba613983a75145e1 | Triage

Analysis

max time kernel
133s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 11:31

Sharing

Report Analysis Logs

General

Target

$TEMP/customcode/Culture.dll
Size

17KB
MD5

ad060608376e3195b4545928f43653d8
SHA1

33ea2c0efcff013562827b2eafa29e0e2ce2f4d2
SHA256

0fd01b0b8c8933af2518e813da69b16a5d60a41f86061732e24fa76cfa9a38ba
SHA512

2c11620bff86974f52bfe1facc9106c4b43c45e2b607bdd184d2f2d2066fdb3f6edd301b27de898351b5109f10d6b18377ef432ddde66c18ba60d68f4073491e
SSDEEP

384:tAseglikMIFYuGzqdQcKV46JWcURKIEWscvwyD:t75FY6dFKmRh

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2388 wrote to memory of 4804	2388	rundll32.exe	rundll32.exe
PID 2388 wrote to memory of 4804	2388	rundll32.exe	rundll32.exe
PID 2388 wrote to memory of 4804	2388	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\customcode\Culture.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2388

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\customcode\Culture.dll,#1
2⤵
PID:4804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...