74c1b2770fba853e40bd68d5618894bb322f8dbddf46eea3e77ce2a291c0143e | Triage

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 10:47

Sharing

Report Analysis Logs

General

Target

xlbbqmrj/internet.dll
Size

188KB
MD5

b925098c6a6330410cffb3994ef36211
SHA1

7467bb63d47ea2fa6dbf3984ede8d9e04b8ce37a
SHA256

f25727ce196ac0ab4119ab7968cdfe18425170b55012fc7fb26a3f824514d82f
SHA512

955ab8e3eb661cf575db0db77ca81fca16cdb3e29ce49237b1df1377d6f2aaff3c6a12bbc98a720f0a67292b39451474b97de31f696688a93547181991fffe0e
SSDEEP

3072:tpTEys+TR7yRoHzXjlhvtcxVIThpEbbAKNXoqlSY9M02MHUP:tpTEt+ycLHlCIThpEX9+XM

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3768 wrote to memory of 3288	3768	rundll32.exe	rundll32.exe
PID 3768 wrote to memory of 3288	3768	rundll32.exe	rundll32.exe
PID 3768 wrote to memory of 3288	3768	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\xlbbqmrj\internet.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3768

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\xlbbqmrj\internet.dll,#1
2⤵
PID:3288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3288-0-0x0000000002500000-0x00000000025A6000-memory.dmp

Filesize
664KB

Download