a77210dc3ae1df36cab033e2b52ca8c656bd5cbc5257a79220526f32f4bf5949 | Triage

Analysis

max time kernel
91s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 22:17

Sharing

Report Analysis Logs

General

Target

Driver/DIFxAPI.dll
Size

312KB
MD5

a23d67c0248290bc25f715d82d454a2a
SHA1

0d62e933e0a9ffda22996fe261d8fa8bdfdc3930
SHA256

5071649d8a44b6b7035b63433ca566305a985da59f82db4d9a1c2566578fe6e7
SHA512

f31de2116853c6de5a98b506b79a233e62a8d4d2461058c2dd92cfa9958b786a6f94f746bf021ce5839f10de05176671b27492fcbbbdab0834140e44684216d5
SSDEEP

6144:njvrIFn6FqaWJbuDvodq8FDG3Ii+F55dPGJfKWX:njvkFODq1UYi+F1PifzX

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 4868	3588	rundll32.exe	88
PID 3588 wrote to memory of 4868	3588	rundll32.exe	88
PID 3588 wrote to memory of 4868	3588	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Driver\DIFxAPI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Driver\DIFxAPI.dll,#1
  2⤵
  PID:4868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads