699ebcd7261ee4d77703e40c5516f33e1a1df5d55b211c864abb86b74b52ad95 | Triage

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15-06-2024 22:19

Sharing

Report Analysis Logs

General

Target

Indicium-Supra.dll
Size

783KB
MD5

a2b0d88eb999664799e5263c055b90da
SHA1

aaa52f473d0c519fd0154cc096b7ee177adf781c
SHA256

cb9f94ac4f4e2bb1576b7178fdd68035067f5836996cb2adef2cab4e7f192cbc
SHA512

442d3cebfea6be743d19a061e104e307303c804d23b958c28a8fbcd3f46c64c474f04fc1f87f492cb1078d838a9ef5be80d58ed5ef827646a5752d10f31d8e1e
SSDEEP

24576:foLHXgkLLPF1NH18kFpZUQuosgP+1QH6Uy:qXl8kFNuosgPh6Uy

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 4320	1328	rundll32.exe	80
PID 1328 wrote to memory of 4320	1328	rundll32.exe	80
PID 1328 wrote to memory of 4320	1328	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Indicium-Supra.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Indicium-Supra.dll,#1
  2⤵
  PID:4320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads