Analysis

  • max time kernel
    89s
  • max time network
    99s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240426-en
  • resource tags

    arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    03-06-2024 19:50

General

  • Target

    ShadowGen By ShadowOxygen/secproc.dll

  • Size

    338KB

  • MD5

    c72b72a6f2eb72bc6dd0a2a2164e02e3

  • SHA1

    18825cc35e84e960c3c26e23f99fdc80bf346632

  • SHA256

    b008544fc732a9c05a1479a2631dbe005e24b69c4abc2922ec7bd87337b76644

  • SHA512

    0b73040f80a477b307efa6ca2baa2d8bac7e203b8a23d7e3e5b7daaedc1940778b805e3fbed5c12cf6516f09e243f77a55c404bf2c12b6ee6288f7b2a80f5f98

  • SSDEEP

    6144:BPefh6YmnoVPDVYITi3KxtLtOLbWUOGR3JZaYE8z0U3twy/8J:BPefhX1VYITi3KxtQeZGR3dCU3twyk

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ShadowGen By ShadowOxygen\secproc.dll",#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1456
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ShadowGen By ShadowOxygen\secproc.dll",#1
      2⤵
        PID:1408

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1408-0-0x0000000002D20000-0x0000000002D30000-memory.dmp

      Filesize

      64KB

    • memory/1408-1-0x0000000002D20000-0x0000000002D30000-memory.dmp

      Filesize

      64KB