0d5d0a7acd5f94c95d0e0d71e5581bdd92fa465baadce7c782319035e5059f77 | Triage

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 02:43

Sharing

Report Analysis Logs

General

Target

wmode.dll
Size

36KB
MD5

4faebc52310fc23a7519caef5e2fcdce
SHA1

da65c6a63c3dff98579d763f20f944b7fc7de279
SHA256

6fea79b168aa75ed9883811411d2f5f6682253e612a398477e842d660459e77b
SHA512

642778694dc9cdccfe7fc6f913b6ff1b6daa1956695907c0da211161f31b472962043a9c68fb498fcd59f9ac8ff7d1c02d0e7f42bc5b91e7129f6a8ba0be0e54
SSDEEP

768:ekvOppeFhkco934HVB+QzjfWIfy+HIxvv6J2HYK4yTGR4:Xv0pezkXaBxWIfHQqJqYDk

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 3056	2448	rundll32.exe	81
PID 2448 wrote to memory of 3056	2448	rundll32.exe	81
PID 2448 wrote to memory of 3056	2448	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\wmode.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\wmode.dll,#1
  2⤵
  PID:3056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3056-0-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download