145f61874694b27ada01450565915cc39ff085d4d1ec4b1e357dd308bc625f69 | Triage

Analysis

max time kernel
133s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 11:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

TileDataRepository.dll
Size

424KB
MD5

20339c1bec7ffc2c7e0390c3f001c481
SHA1

65c7be6e42a69a60b149b1a6074727d30d2e7dfc
SHA256

145f61874694b27ada01450565915cc39ff085d4d1ec4b1e357dd308bc625f69
SHA512

83a9bca3e9899cb9cdbf26b1bcf43ef63afb6f7dcb05f606853cf983ce59b5c19fbfa12f7be0245131d4632450b56c6b256928427abcf76938784f257ec022cf
SSDEEP

12288:G6XDFDJXPmGayMHEqZt/eUk1qPpBZChZw:1dXPmGayMHEqZt/eUk4PprCh6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 1564	1228	rundll32.exe	83
PID 1228 wrote to memory of 1564	1228	rundll32.exe	83
PID 1228 wrote to memory of 1564	1228	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\TileDataRepository.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\TileDataRepository.dll,#1
  2⤵
  PID:1564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads