662ce2779aeca5637684558f792f43c114ff5d6dd2568c351f7cccd0dfab935c | Triage

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:35

Sharing

Report Analysis Logs

General

Target

BackendModels.dll
Size

14KB
MD5

01f030e89968f7d8bc47f7ce94296481
SHA1

0f0b7342d56e6ffdf7d813bc00ebc79b8c975482
SHA256

a0ae31e9b5b5cc90a2d9364bf233011cafbd667f2071b8fb9296fd7607136d08
SHA512

8df44a4cc580b4690fb5ebb775bbe57decb0bd86f44d4fc82f4127334b08b3941257004be4c3f03a454cea6e6cc8c86c17a3ab076f0988d8a4d815a895c2a231
SSDEEP

384:ZHa+TZxtCAlzbU1qG0sdh6pgxxLkMNbH/+xFirYWY:U+T3tzlzQxhv/+xK6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1076 wrote to memory of 1808	1076	rundll32.exe	rundll32.exe
PID 1076 wrote to memory of 1808	1076	rundll32.exe	rundll32.exe
PID 1076 wrote to memory of 1808	1076	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\BackendModels.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1076

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\BackendModels.dll,#1
2⤵
PID:1808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...