e51bac091a171091098a61a2706c410ff7896d04f1f82bcec6c8b42447544805 | Triage

Analysis

max time kernel
135s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 02:50

Sharing

Report Analysis Logs

General

Target

MenuRes.dll
Size

212KB
MD5

07ddfae24bc83bba3c0a218ca7a5ae0d
SHA1

ed34ca6e9bd81ccada2d21ba086033166d6f719e
SHA256

9e2f7291cb47e41bce7002a534b2f3845a819e674d9c887f3f0fda1cdf0a8ead
SHA512

691bae3a11d894ffe5dbce1d29c41bffb98a4fb63ed9df16442e8822e513ee8fa293fbf244653f16e6c63ceef0d0b8bffe1f7f61410f8a3ae0e3bbd4c49cc0cc
SSDEEP

768:LTZC7f93nnqvQCDN3HY31S4gSyIF+jgG596x2y/lLw8hLgzw:LTZFy/lLZ+w

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2404 wrote to memory of 3468	2404	rundll32.exe	rundll32.exe
PID 2404 wrote to memory of 3468	2404	rundll32.exe	rundll32.exe
PID 2404 wrote to memory of 3468	2404	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MenuRes.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2404

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MenuRes.dll,#1
2⤵
PID:3468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...