d1132df2f76ce5a708ccf760732953f04f7922aecb2b86e9a5b1dd35494da72c | Triage

Analysis

max time kernel
92s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 00:46

Sharing

Report Analysis Logs

General

Target

Plugin/ConfigCenter.dll
Size

443KB
MD5

e3c6ab52c6ed4d14e7fbfc32309f3ba9
SHA1

f372c4a8599d46ae23ccc9325a08b9da689d86de
SHA256

c0d5a190b0daa1e06ddbe5801827b50eedf6bf70bd48271686a613726c97d04d
SHA512

ce8e2fb5c982b8c0c4622416d4af5a7a648eb793e027ecec6ee522b1cd7119490e682398a2847fe4c7e19b7a525577e5ae978544bc647d1a879a825957149d9b
SSDEEP

6144:iCkfLsNQigo5pnev/CX7OXcwxhH7n1W7FDcYBXAOQtghUau6:i1AaiTvneH+7OXR5w5AYBX22O6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1468 wrote to memory of 3928	1468	rundll32.exe	rundll32.exe
PID 1468 wrote to memory of 3928	1468	rundll32.exe	rundll32.exe
PID 1468 wrote to memory of 3928	1468	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugin\ConfigCenter.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugin\ConfigCenter.dll,#1
  2⤵
  PID:3928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads