8b56d75369b933d12b1468863c0fd035a36e0781c928683d2e315cd05fbc05b2 | Triage

Analysis

max time kernel
137s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Release/Resources/UAC64.dll
Size

137KB
MD5

064e92695a1af94c39c2d1f936fa183f
SHA1

25653e3665fa5beee5f2eb4c6cece23b7b0a660a
SHA256

6de1117c5407b0e061856351da89328bf6ef3f09ca59633547b8ea095f36625f
SHA512

138f3c0fae05f342a10be4be35876c286a47020e90aea036ffd8e450a1a07ceb7d1a1a9aee53665e52ea3ae571dcd3212c6289f1650313c95ad6d9903f71d369
SSDEEP

3072:LVVTOhqDnT193DO9YXUCuEy7Yh6Jd2maK1FckPxiTn/FSGj:LyhqDnx936aX3A7g6JhIcG

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 4232	4748	rundll32.exe	82
PID 4748 wrote to memory of 4232	4748	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Release\Resources\UAC64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Windows\system32\cmd.exe
  cmd.exe /C "%phantombp%"
  2⤵
  PID:4232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads