8e56f1c06a4020dd85da5f8caf8d8660dcddc99cffe1f745ae9cc2fec5779227 | Triage

Analysis

max time kernel
134s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 12:30

Sharing

Report Analysis Logs

General

Target

NcdProp.dll
Size

19KB
MD5

5ef8494b08da187e27a9a07546783c98
SHA1

219a811a38746e9d80bed794a2d6a4d753b9aeb2
SHA256

8e56f1c06a4020dd85da5f8caf8d8660dcddc99cffe1f745ae9cc2fec5779227
SHA512

394947d265ff903fe692ccc6c1c5aff833853e08960c937f69911749faaf5c822f449383b0442f9ac69127c4d3058fc9db1ead2c26f83a05e654c7e5269b2016
SSDEEP

384:CsbDdC8Z2KHyE1aEZXXKw3YmROp31A/CirgMiCVxgxWyOvtWE:C78Z9Hyl8JYmkMFeo

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 264 wrote to memory of 1984	264	rundll32.exe	83
PID 264 wrote to memory of 1984	264	rundll32.exe	83
PID 264 wrote to memory of 1984	264	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NcdProp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NcdProp.dll,#1
  2⤵
  PID:1984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads