af7abd95bb5467551562f129f03c7ac9d52a021f7e547609f40a80e66932c942 | Triage

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 12:49

Sharing

Report Analysis Logs

General

Target

apphelp.dll
Size

289KB
MD5

863f793d15b4026b1a5fdeca873d4d84
SHA1

c14e0a6c61834d559dfc4328c25a7fd90cc515e3
SHA256

af7abd95bb5467551562f129f03c7ac9d52a021f7e547609f40a80e66932c942
SHA512

890ae1c21ce37bce90054328bb6975bc0ede2c4d25c0b19a1ffae1353cd723ba684827e84e58e472e07de35aff13cfbdb680e89df51da90194349606be8e904b
SSDEEP

6144:sPvgD9QAG2q2TM6s+t8BA8jcxmZkClvEauLSVpbF9:UvgD9s2GvYA9Hu4r

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 920 wrote to memory of 544	920	rundll32.exe	82
PID 920 wrote to memory of 544	920	rundll32.exe	82
PID 920 wrote to memory of 544	920	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\apphelp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:920
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\apphelp.dll,#1
  2⤵
  PID:544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads