160ef66ca712ffaa274986b829c30741905554c50fd917a14cbc8166baa434a1 | Triage

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 12:52

Sharing

Report Analysis Logs

General

Target

KernelBase.dll
Size

269KB
MD5

a52d3d13ff656a2846d1e7ca4e597e57
SHA1

95a79908e38a7456c00c1bbe415e4ef13f95e127
SHA256

160ef66ca712ffaa274986b829c30741905554c50fd917a14cbc8166baa434a1
SHA512

e72526d45f0937794f5b9e4a3fafd5c4c83f325094fe4537a7191c97fe08ff5a0e1cd14f3fa555def8a1ce66a82842675461e4932c14f499894e933858b4496b
SSDEEP

6144:JfU3YEUxMZtu3cluZTbbpngjRcwV03M3Cn4pHeXdDs:JfGYEgMZtur1bbpnSRcwV0c3Cn4pHADs

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 2516	5072	rundll32.exe	82
PID 5072 wrote to memory of 2516	5072	rundll32.exe	82
PID 5072 wrote to memory of 2516	5072	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\KernelBase.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\KernelBase.dll,#1
  2⤵
  PID:2516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads