9414070d85369b2dff11b5b826307ad422ed75b38cbe3d015fa726cfa029f611 | Triage

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 12:12

Sharing

Report Analysis Logs

General

Target

AppLockerCSP.dll
Size

229KB
MD5

e0d5edc4f5065aab48196626f4ab9cf0
SHA1

417a6de3109eb6e861d76fa39ef5373c0d0c2926
SHA256

9414070d85369b2dff11b5b826307ad422ed75b38cbe3d015fa726cfa029f611
SHA512

de4e7fc55d270a92dc96ad3005512cbd94cb8d47962dc5c4406350506f29d9d817487b3a0ef43999e118a0f50f5095a77621c4bf69c21e4ec90be0c9496542b5
SSDEEP

6144:MAQIzPmI0mDfD5ZTe0XDLwZaBTjzgW6+:MTIaIB20X/Aa5jkB+

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 4768	4784	rundll32.exe	82
PID 4784 wrote to memory of 4768	4784	rundll32.exe	82
PID 4784 wrote to memory of 4768	4784	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AppLockerCSP.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\AppLockerCSP.dll,#1
  2⤵
  PID:4768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads