a7b38fbf1a36a09613d25573c8d95783fb0a0991cfddcf69d19c0828936c8dd3 | Triage

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 00:02

Sharing

Report Analysis Logs

General

Target

gg/iext.dll
Size

216KB
MD5

cba933625bfa502fc4a1d9f34e1e4473
SHA1

5319194388c0e53321f99f1541b97af191999a09
SHA256

25549c7781b3f1b92e73b0ea721d177207cce914a66f3229a71291f2eb160013
SHA512

f5fb4b97c4f68a20e0847e6528740ce659c4501726f3b2dff1ac83e88a3b7198099da03edb0f069cd4af7ed568a2373597b235cd239895addfa5226d3a444142
SSDEEP

3072:1dh+NmslaQ7iAvBvXo8M360VVQrtPdDMDyowHhRJl5pnR:iiGK8M36zVdRL

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 1632	4956	rundll32.exe	80
PID 4956 wrote to memory of 1632	4956	rundll32.exe	80
PID 4956 wrote to memory of 1632	4956	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gg\iext.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\gg\iext.dll,#1
  2⤵
  PID:1632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads