869097ce0b1adb4ea795c46df11cff474cacaf39d6f2aea2a4ed3880fe20ed34 | Triage

Analysis

max time kernel
131s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 12:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ShareHost.dll
Size

553KB
MD5

645dfdae0f91de695029976b509597be
SHA1

ed819ef6002d2962513461ef2bc9c46107b12d51
SHA256

869097ce0b1adb4ea795c46df11cff474cacaf39d6f2aea2a4ed3880fe20ed34
SHA512

e432f98e9cd7ed61379e4a5fed3b6f3b90a6f16c4432b4d1c6bf1064f3d3d8f2cb780da45d302b724416283be45f72ecec6906e3237f3c9796a82bed31be2b07
SSDEEP

12288:1DWHqmUTzteF2SOlGsJPYDV0UbKqaagu:1ZHm2SOlGsJPG0UbGagu

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 2404	540	rundll32.exe	84
PID 540 wrote to memory of 2404	540	rundll32.exe	84
PID 540 wrote to memory of 2404	540	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ShareHost.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ShareHost.dll,#1
  2⤵
  PID:2404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads