a52ba33e7b386e933d1a6ae99f257315935d4c68cd21f91e987d327683f9c990 | Triage

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 03:03

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/brh.dll
Size

840KB
MD5

355c877b0a9c80d27eca9a480bf5fd5d
SHA1

af1d07a1d11d7f3e24d84324cc0cf70849da9338
SHA256

2e484b9053b5e155608fd10da190d4ee92c2286eea2a3f2ee6c564f24e8c1bba
SHA512

b2f115824617c9c23ef9df3b89f0cba6852071cd997ecb543cf1ca9c72fdefa636a74d25393c70c4ae2f602f499d5704c0917e8036c81537f8e07f0c0ee50250
SSDEEP

12288:FvnZF0XRBJ+csqI7I82c9LOsgxzO84KLdOsG6y8f:FRF2RBJ+qoXkI84KgN0

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4656 wrote to memory of 3144	4656	rundll32.exe	rundll32.exe
PID 4656 wrote to memory of 3144	4656	rundll32.exe	rundll32.exe
PID 4656 wrote to memory of 3144	4656	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\brh.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\brh.dll,#1
  2⤵
  PID:3144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3144-0-0x0000000074CE0000-0x0000000074DB8000-memory.dmp

Filesize
864KB

Download