2254d625ca4e9074ac88199d91e78de8fc6979e6850674c409624c765bda7092 | Triage

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 21:06

Sharing

Report Analysis Logs

General

Target

Modules/Base.dll
Size

106KB
MD5

df264efa2c5285aab9700b30afcf5852
SHA1

1f8e3d1577b7f416ec763f2c8c585b8647ddb6db
SHA256

027cf7f9074a2306ad323254a79205f33b2ec24085a93efe186057230121755a
SHA512

ad0b1dd7a5f658d8c7b408455dd87bfc87b1690f6ee355a88287e8e96adc609dabc94ca831cda42b156480c21b760ea8093df5af26bcadb0259bdee5cc8fb069
SSDEEP

3072:WI6YCV7JGhaLWXg91eTzN1q/jva8I/+/VZM4vCo2:WI6YCjFSXgzed2La8I/+/VZM4vC

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 1996	2712	rundll32.exe	83
PID 2712 wrote to memory of 1996	2712	rundll32.exe	83
PID 2712 wrote to memory of 1996	2712	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Modules\Base.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Modules\Base.dll,#1
  2⤵
  PID:1996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads