880514cc9f89c732525353bcfff9c3e69e8e7958daa82e0bc3e196ef479d4b84 | Triage

Analysis

max time kernel
615s
max time network
1596s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
15/06/2024, 08:53

Sharing

Report Analysis Logs

General

Target

Masscan Advanced Mode/Packet.dll
Size

94KB
MD5

1250bef11bfa086f772cd2a273bc036e
SHA1

bfb60b4072f4533d8497f3d90631f818e345bcc6
SHA256

6b19cffaa2bf4359be1a0130a1fb47ab45e8c3be5d0cb7986579c5e04e1d77a5
SHA512

76cbc346468d400c4e6a95b3c91abfec0a63a375aade6f47c70a3b3db76c513bcfd91ed2994059a6c8bdd6b266f9b17ecf11f9941481c7a2692925d2457f5bba
SSDEEP

1536:6wG9plhvRIRVC2wJAyPFCnPKc0z70yIKtIn8zVpWj:E9rjh5t9cZyIKtInb

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 3132	3936	rundll32.exe	74
PID 3936 wrote to memory of 3132	3936	rundll32.exe	74
PID 3936 wrote to memory of 3132	3936	rundll32.exe	74

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Masscan Advanced Mode\Packet.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Masscan Advanced Mode\Packet.dll",#1
  2⤵
  PID:3132

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads