a7b38fbf1a36a09613d25573c8d95783fb0a0991cfddcf69d19c0828936c8dd3 | Triage

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 00:02

Sharing

Report Analysis Logs

General

Target

gg/krnln.dll
Size

1.1MB
MD5

ec2dcc79b50fd1cf5367e140931611ff
SHA1

ff958ff763dbc8b4fc8bd503d934e5b03fe8e81b
SHA256

2f70278b624ba9a7aae80fc04e01696e12606543c6b9cfdaf26a5d2f00bdffd9
SHA512

7fa7748f850018e160b263ec62fd25a10758ff279f47b75b88e4adf3a37df7c6d7a7486f50e0385f3542fe5d061908aeb7ffc12bbb34d14351897e9f4af3bc57
SSDEEP

12288:gRZTEr9vWWBjekIPNSohrqbTkjd67pStJgkyOPNMfvsnIPN1m:vJvWmeP5rqnkwpiJxyOPNMnrN1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 3988	388	rundll32.exe	83
PID 388 wrote to memory of 3988	388	rundll32.exe	83
PID 388 wrote to memory of 3988	388	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gg\krnln.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\gg\krnln.dll,#1
  2⤵
  PID:3988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads