e51bac091a171091098a61a2706c410ff7896d04f1f82bcec6c8b42447544805 | Triage

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 02:50

Sharing

Report Analysis Logs

General

Target

Plugins/BILINEAR.dll
Size

4KB
MD5

bf6f6fb662d778213cff462021a99d79
SHA1

d7fd55131106dc75533b809ea9011d16227a22af
SHA256

49296daa1bf5d4f288e93dc812b9312089c8642284f30ff703ff358ee89beec5
SHA512

b89aec98481c3205d73bad34d00f20b9a8a07032029af618d8aa324e3fec9fcd4e07417082db756d73f6b4d0313d6568a10bbe353773b572fea1e52a31983933
SSDEEP

24:etGS4NBII/qXXPP3C7qRKgctuDHl73pWuslqMujgy5pSd+lwNxJ3KynB:64NwnPP3iq3Dx70zqM5JUKayn

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4716 wrote to memory of 1884	4716	rundll32.exe	rundll32.exe
PID 4716 wrote to memory of 1884	4716	rundll32.exe	rundll32.exe
PID 4716 wrote to memory of 1884	4716	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\BILINEAR.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4716

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\BILINEAR.dll,#1
2⤵
PID:1884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...