48af9f4898c0828622ba993fa4326846d3e7dc527b07510f5447303b42424b90 | Triage

Analysis

max time kernel
132s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 11:42

Sharing

Report Analysis Logs

General

Target

PCPKsp.dll
Size

52KB
MD5

463873126358017a07ce8976451759ef
SHA1

c3343ab824824090b30680a3ae4776dd17d74947
SHA256

48af9f4898c0828622ba993fa4326846d3e7dc527b07510f5447303b42424b90
SHA512

594835c0adc49b5dd5ec1d759a88e5e279dc761469366b12442b5ff207ee4efe1e56f32764c35d55f50bed7e3ac95f5c7458d231216e4dcbb6781f85cee8ffb3
SSDEEP

768:kCMWUVj1iW8aCi6a+RqJ64hX5vh1fWvoYNr/R6INio4/gSd0Nu:kCM7NoWBCi6PoJDhUwE/R6I4Tgw0Nu

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 2624	3248	rundll32.exe	83
PID 3248 wrote to memory of 2624	3248	rundll32.exe	83
PID 3248 wrote to memory of 2624	3248	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PCPKsp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PCPKsp.dll,#1
  2⤵
  PID:2624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads