39e1780e7003dfbeb31a0b0c1d1c9c72c7eeaafa30cd1408757b9ceb56916e93 | Triage

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 15:28

Sharing

Report Analysis Logs

General

Target

TKMatchInfo.dll
Size

248KB
MD5

41774b2be6352f6da2e47e0dd896b37a
SHA1

b000754e2a47602632f8e400654b4a7553f6124a
SHA256

29c629557e19264f36fbb3c364de70c12112172a8b80ebfccfecdd5fa2819713
SHA512

2f029b7216419ad3c7f40914714eca4df91da3f5520ffa0fbcf182aa0207daf49f2a805bf892e5a9ea28ec52ed1ba436eeaef8db7e708748cc3ce9caa5b5a400
SSDEEP

6144:LT+2YZpQXdcAqenApR6/IA6LpZO6h7loD+yulXYcVewQqlwnx8uHu0niVG+LZ/ju:LrNANAYRi+XQZ1aEZv

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 920 wrote to memory of 4480	920	rundll32.exe	80
PID 920 wrote to memory of 4480	920	rundll32.exe	80
PID 920 wrote to memory of 4480	920	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\TKMatchInfo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:920
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\TKMatchInfo.dll,#1
  2⤵
  PID:4480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads