c3292a1a8b5708160e8d863844eb20ee0aad7ea0d827cb7bec429c70416f35cf | Triage

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 12:44

Sharing

Report Analysis Logs

General

Target

lib/bin/cmm.dll
Size

188KB
MD5

09f3599ea16b29d058af4643ca3de114
SHA1

8c159ffca46e1ab3f68060694bd51dcfd7b5ca91
SHA256

ea68a79686fcfef9f1b0c9c164cca1adee62113d46d7dc7efcb93d73180dfc5b
SHA512

1b7f27eaa3030a53735402b11b41e2a76fdd69f09f33184696d2394043fa4319a2615849e77e56e11995dd464be525c2c622f743ca37f37574fa77d4b0b4c0f0
SSDEEP

3072:svkU0Rh5hA/qvraiLSNyUuiZtoc4qToCe98cecykbyHeS9h:1U0RhgqDaiL0ToxqToj8rcG79

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 992	2064	rundll32.exe	83
PID 2064 wrote to memory of 992	2064	rundll32.exe	83
PID 2064 wrote to memory of 992	2064	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\bin\cmm.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\bin\cmm.dll,#1
  2⤵
  PID:992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads