12978eef9daed92259dc10c461bdf027cc646b49425f9941da73d4ded1483d86 | Triage

Analysis

max time kernel
49s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 20:18

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/Fusion.dll
Size

791KB
MD5

9af7166d3ab582fd346a3a5786ac0c0d
SHA1

3f28ed3875316949ce49938425d05b095a0d08ca
SHA256

922755fd3c00121a57b4c7748e84ec56baf77178dff63ed88583ea80276bcf7f
SHA512

723fed5d920bef822045ea9d6e0052c907c49edec4311aafc6a9c0f5bafec52184780f8b65fabc4be477cc98c19c98350c5acbaf17ac2f5b484d8bc93046b30a
SSDEEP

24576:0KSIfVRdfa0cJHvSxrk5Fi3+UA12K3nDN:0OMfJaxSz12mn

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 1320	5020	rundll32.exe	83
PID 5020 wrote to memory of 1320	5020	rundll32.exe	83
PID 5020 wrote to memory of 1320	5020	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Fusion.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Fusion.dll,#1
  2⤵
  PID:1320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1320-0-0x0000000002280000-0x000000000234A000-memory.dmp

Filesize
808KB

Download