ccc75ee30e31cdfe33c78d3dcd68a9a766860878e467eff42211e4ac629f4e0e | Triage

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 10:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/GetSid.dll
Size

88KB
MD5

b820c51a5ada0e16d7d1285b26440c82
SHA1

5e4cb96cb2d92a0df9f259b99ded953974926263
SHA256

57c97302704da7b47d24e88e06ff6001c3f5d35463bb6b3ecc283b24bd30643b
SHA512

ffb8824def44e0767992a2e415e8695ebff71e8d7f740ea0864ab773c63f44060e947f5c2c7dc8cb1b0ff2861dafae22a708240dea92159e0b98edc2f6a120c7
SSDEEP

1536:ibddSkCTEl0ZViN8U4fduuJlbAlbFZsbH:/W0ZX6OlElHmH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 4220	1332	rundll32.exe	80
PID 1332 wrote to memory of 4220	1332	rundll32.exe	80
PID 1332 wrote to memory of 4220	1332	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\GetSid.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\GetSid.dll,#1
  2⤵
  PID:4220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads