a77210dc3ae1df36cab033e2b52ca8c656bd5cbc5257a79220526f32f4bf5949 | Triage

Analysis

max time kernel
91s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 22:17

Sharing

Report Analysis Logs

General

Target

CommFunc.dll
Size

48KB
MD5

5b7f1d585c7cfd7920f028e6dded4ef4
SHA1

c8046b57026342b66e33c4a2b27ba55df6d6b8d0
SHA256

c12617b0bec1131e16b5ff4159dd62cbfe0cd86a2cb5f2fe8873dc3d00f60c9b
SHA512

2d74f5201f4a30807216433f2302cd5e709db8f00f5f0ea13d937f278df69bbc163b3b2f1a319a249b781860f5458d185293e8590f9a19e56fafa391bc52edc2
SSDEEP

768:4FVGiCx/ho1QIeDhNdWQvJQbJu3M4p6cshkPkZr63mnjEDQxKak9LSG:4FVGiM/i67bJQ1M/ULkPAmQJRG

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 1344	2652	rundll32.exe	89
PID 2652 wrote to memory of 1344	2652	rundll32.exe	89
PID 2652 wrote to memory of 1344	2652	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CommFunc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CommFunc.dll,#1
  2⤵
  PID:1344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads