b89486615e9d50de29121851eb142207202c5aa9bc948ea0cfcad5016d5acc08 | Triage

Resubmissions

28-06-2024 16:48

240628-vbh9ssxakg 8

28-06-2024 16:39

240628-t58acawhkh 8

Analysis

max time kernel
418s
max time network
1172s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 16:39

Sharing

Report Analysis Logs

General

Target

patchclient.dll
Size

128KB
MD5

4225ed93fdd49259965f983fa66236a6
SHA1

37c410334191c5ba73254dc5d434c1e066c7f375
SHA256

bf9cd946e71ad9e5ea23d4f0e41fd8812b808f5dbd2291802b2d9ba871aa36d3
SHA512

f9022871ca35ee799bcf2ff929d68daf541ecd359e2cd76b446c012f33cd691cac65947e5976274b76569559d7b6b459d2bbec1f1836b3a0be85fb2782f7dacf
SSDEEP

3072:drpIu3+0VWtxTgmCqfmXi/13adBXrcEEopl3TXXmF9T:driu3RcgRqeywXCGjXa9T

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
18	4040	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 4040	2032	rundll32.exe	86
PID 2032 wrote to memory of 4040	2032	rundll32.exe	86
PID 2032 wrote to memory of 4040	2032	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\patchclient.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\patchclient.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:4040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads