70f96651e4d848e386e66d754f2f6ef530b591587983e6ad8348d17ae66bb9d8 | Triage

Analysis

max time kernel
90s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
27/05/2024, 08:11

Sharing

Report Analysis Logs

General

Target

vac mod/Fasm.NET.dll
Size

158KB
MD5

6392d2d3b6c7526375f4c8a75e02b590
SHA1

a063d3b9345c211d9f251ac6846befeb8c9e8b11
SHA256

f4f7a3cff105712a7058b7a7f425370cd5fb85e8287da0f99a56e541e59f11dd
SHA512

5cd332069c7a6faf251df84072fcab82ec4dfcce126371f5bb40b8d9bec49d72478a892f96587ba3e7547ca98d5bc542cca2ea5b61e9e68ac5d2c9e0943188fb
SSDEEP

3072:beC4Y0xTD3DJ36Jq7Y5+s7WIxFccjb+uhQR27YZDKkpWMS1:beJY0dD3tASY0ynkpWMS1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3360 wrote to memory of 5024	3360	rundll32.exe	78
PID 3360 wrote to memory of 5024	3360	rundll32.exe	78
PID 3360 wrote to memory of 5024	3360	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\vac mod\Fasm.NET.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\vac mod\Fasm.NET.dll",#1
  2⤵
  PID:5024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads