d1132df2f76ce5a708ccf760732953f04f7922aecb2b86e9a5b1dd35494da72c | Triage

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 00:46

Sharing

Report Analysis Logs

General

Target

Plugin/PopMgr.dll
Size

1.3MB
MD5

62787027f2adf82c2e1f07b93eb964d2
SHA1

7640575961d58f414e5f2ff78ac1f34aa7c67d33
SHA256

15675015eefb9bc51e991f3a0fd05f836694dca01a9b7fcdd1e42ffc7ce727a6
SHA512

19f935aff0056df79a62b151ff09691967c288010ce99c3d99b388837a32271b61dc7a5d11ad459aabe625d3a169b4395289eae3cfdcb4cb5c15ad18b435948d
SSDEEP

24576:K2QO56cvFDe0+KpYQ0LnePuoIR3T6XtYhLkjt5xhX:KWbDeLKpYQ0LnePuoIR3wtYFkjt5xhX

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3988 wrote to memory of 1780	3988	rundll32.exe	rundll32.exe
PID 3988 wrote to memory of 1780	3988	rundll32.exe	rundll32.exe
PID 3988 wrote to memory of 1780	3988	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugin\PopMgr.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugin\PopMgr.dll,#1
  2⤵
  PID:1780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads