4ff106af4e32c49f975f137e13ab8b0f22c88d34c2a6b34f4ead3a75d940b1f7 | Triage

Analysis

max time kernel
133s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 14:22

Sharing

Report Analysis Logs

General

Target

SystemTransform.dll
Size

711KB
MD5

5654920a45213caf4131b0c89cbc80d9
SHA1

1ff79fe33b5190568a527029591ff269f99e6031
SHA256

4ff106af4e32c49f975f137e13ab8b0f22c88d34c2a6b34f4ead3a75d940b1f7
SHA512

a0d6c4c51c3e2dcb863aeb73b6aa51fad8e9536172cbac0d7393ccba7e6eda82d75ecbfa6a49aad3bae0211e68009d3293d416b0c0080d9adabe32878edfa09d
SSDEEP

12288:EyIP2UNsVWZZUvn6OJk0v/4LUBU0AJVYe:ELP9ONJ/oLUBUy

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 452 wrote to memory of 4904	452	rundll32.exe	83
PID 452 wrote to memory of 4904	452	rundll32.exe	83
PID 452 wrote to memory of 4904	452	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SystemTransform.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SystemTransform.dll,#1
  2⤵
  PID:4904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads