d1132df2f76ce5a708ccf760732953f04f7922aecb2b86e9a5b1dd35494da72c | Triage

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 00:46

Sharing

Report Analysis Logs

General

Target

Plugin/ConfigCenterStub.dll
Size

226KB
MD5

1fcd2e7a7201286b8dc26f241f953618
SHA1

9d6b30df85e8ed16e72d2843b38f43922d9568cd
SHA256

fc5b93b4a773c0d8f657c873fa210e1e7702c8948163a12ad88e32771eaf240c
SHA512

f4253da097fbbe6f265339bef875374a5e34de85a0e96869667432b4466be505b503a28210a3e56f7dea28e0a50ef680b59493b0ab3e17eb03c853a621428cf1
SSDEEP

3072:paUfIPxGuULh0UJFuPw0W7rz5gzvVzEpF19E25QAZkiDt1mFk:SPx1phwl7rcNzEpJmmFV

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 536 wrote to memory of 1692	536	rundll32.exe	rundll32.exe
PID 536 wrote to memory of 1692	536	rundll32.exe	rundll32.exe
PID 536 wrote to memory of 1692	536	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugin\ConfigCenterStub.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugin\ConfigCenterStub.dll,#1
  2⤵
  PID:1692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads