fb037b4fa9732946abaa8d1e052c7b848230ef6ed26b8b46d105001b9025f218 | Triage

Analysis

max time kernel
134s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 12:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

libemv.dll
Size

248KB
MD5

f2eab90ad9d2a2166d31216e8f935013
SHA1

13943b6c37118e3d85e4ce47e1d635526d3cb7f1
SHA256

fb037b4fa9732946abaa8d1e052c7b848230ef6ed26b8b46d105001b9025f218
SHA512

4dd05695dee21a59571878ece7e89566bd9144b91a487c5f2b0acd2a2ed26653cb90d7e6b63bd440be3af6da22a1525ba650d5cbb8a444a79844495c69f941ec
SSDEEP

3072:CeM5JRTkwAmSyRzhGQbuSmhBdPP0f3C4Jd8d6QeBevzqG/gA:CeM5fTkwAPyRTuSG+f3C0dtQw8zW

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 60	4196	rundll32.exe	83
PID 4196 wrote to memory of 60	4196	rundll32.exe	83
PID 4196 wrote to memory of 60	4196	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libemv.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libemv.dll,#1
  2⤵
  PID:60

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads