2254d625ca4e9074ac88199d91e78de8fc6979e6850674c409624c765bda7092 | Triage

Analysis

max time kernel
93s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 21:06

Sharing

Report Analysis Logs

General

Target

Modules/alzm.dll
Size

38KB
MD5

a1b7e11dd9e80402e5654398d65760d2
SHA1

c2e05af5b57f5ef0f77c905780e799cc48fe8e91
SHA256

ca3837873f2fd36d4646769990ddef0a5d3549bccb1d11174d37b493c4e31b8d
SHA512

f328478f6e2681319f5a824737818f75d7ee9c7f8c1f63ce2a8e9813c87fd71118a00547664965f6c4d79b888fa473011578c5c0491faeccfd6908cb3cff0425
SSDEEP

768:8/PidxjnQyslT/H4mKFnYzNjMLwpr3TScciY:sPidtnPgrHpzNoMpzTS3iY

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 4720	2820	rundll32.exe	84
PID 2820 wrote to memory of 4720	2820	rundll32.exe	84
PID 2820 wrote to memory of 4720	2820	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Modules\alzm.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Modules\alzm.dll,#1
  2⤵
  PID:4720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads