3fd157484c55d7b3871ed546865836985ec4995a38fae1b1719ceed6dfb5bb67 | Triage

Analysis

max time kernel
50s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19-06-2024 21:20

Sharing

Report Analysis Logs

General

Target

Kernel/PiPi/KmBugslayerUtil.dll
Size

25KB
MD5

b81c426c5cf1e529cbe740237a87f33f
SHA1

eeae32c6916e18a15f33df4820684818c74ffa55
SHA256

e2c8764c4b352f4d33674b0e86208833bb8e8b86bc2980d844472d8420105922
SHA512

05f75ec8ec8d20a6588c85036e475b4cdf7ba94b0ec9456a2e20d5f833c9cbdd77f668f5b2bc88abcdc4deae6c2b45bccb6573fb0e11ab87050b7b56cb41f2a6
SSDEEP

768:EdwgB11lgtyiiuizl3JNEsaHjLeITLL3wBuPItoRi:hwjgFy1JNEsaH/TnAfyR

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 5080	4312	rundll32.exe	83
PID 4312 wrote to memory of 5080	4312	rundll32.exe	83
PID 4312 wrote to memory of 5080	4312	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Kernel\PiPi\KmBugslayerUtil.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Kernel\PiPi\KmBugslayerUtil.dll,#1
  2⤵
  PID:5080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads