048bafef6ec2169084b1c8ebc79681275dcbbf3cb5c6617ab2c37e0d26fc3aa8 | Triage

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 14:15

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/mt.dll
Size

7KB
MD5

4fae8b7d6c73ca9e5fc4fe8d96c14583
SHA1

10865e388f36174297ec4ecdafd6265b331bfdcd
SHA256

069db1a83371dcd2dd28a51def6cef190edcac6bbf35b81b7ee3c52105db210f
SHA512

73a5547c6d83227a08e2427f2e5eb6abf429d4b5b7e146fcd59b9fb8c9cc6eb9ff61347a3d46f83d0c7adbaff15e94e70bf40660c217f48e9a46a6e310aaf6b1
SSDEEP

96:Q934+YOERFWe2B1ZVtKW5A8V6dIUTY02J6qCtX:24FdL8vN5AHdIUTRw6dX

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 3096	4048	rundll32.exe	82
PID 4048 wrote to memory of 3096	4048	rundll32.exe	82
PID 4048 wrote to memory of 3096	4048	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\mt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\mt.dll,#1
  2⤵
  PID:3096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads