74d844f672b370c77046ca6206e911d68d57524b1e74569fcd0bfdafa0d870c9 | Triage

Analysis

max time kernel
94s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 12:51

Sharing

Report Analysis Logs

General

Target

ReAgent.dll
Size

922KB
MD5

4fd4be7ba245886ed70e68aa388ad345
SHA1

6269e715d96402e2145065baaaea210fbf819a78
SHA256

74d844f672b370c77046ca6206e911d68d57524b1e74569fcd0bfdafa0d870c9
SHA512

ac079b160b620efc154c1b97ad476e2ce4d562a04cf75dbd291360a5b12a1cdbb141312fe8c226438511dfe51d215caeecfcb17af60f50d1b8195e7cf11ea6c2
SSDEEP

24576:xtRXjoz2KJLJXJkJj6gLdKzaJ9AadTd+M3KGxkgMbK9ZVAOUqVm:PRsqQgJJ9Rdb35kgMbK9ZVAOTM

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 3620	4400	rundll32.exe	82
PID 4400 wrote to memory of 3620	4400	rundll32.exe	82
PID 4400 wrote to memory of 3620	4400	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ReAgent.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ReAgent.dll,#1
  2⤵
  PID:3620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads