ba090f00dec7afbd561670d2a345193fe2d8c10688aa3b5c73972918d1a55a4a | Triage

Analysis

max time kernel
93s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-06-2024 05:25

Sharing

Report Analysis Logs

General

Target

ConnUPnP.dll
Size

31KB
MD5

2b7bfdda4cf5e5cc4f5ce416b970ab22
SHA1

b3c4f26d0242d8a3db4f542adab5ccfcca587842
SHA256

f71b91f79cc2fb048624c98b9fe15c3f01353d1017d1934b60210ac39d079b13
SHA512

7c3a5cdd37ba5b028aef9970d9695786b22e607da58d6dee3613d026e26bd103e275fd42e4fbb95b9f91a7fa18fd1a729ee92018510cd4560313c8b2db4f8f88
SSDEEP

768:KSoZFmqVpEng40b3BdhiXy8XqYduyqvfv0ULCiR:KSoZo4pEng40b3xiXy8XqYs/fMUOiR

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 536 wrote to memory of 1620	536	rundll32.exe	rundll32.exe
PID 536 wrote to memory of 1620	536	rundll32.exe	rundll32.exe
PID 536 wrote to memory of 1620	536	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ConnUPnP.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:536

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ConnUPnP.dll,#1
2⤵
PID:1620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...