8d87897242b12a5327ce2f4d6b5087a9a7c6071722c34e849b95730d6b7c1134 | Triage

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 20:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

system/encvag.dll
Size

147KB
MD5

dc48574dc8c7b4df5708a53af50afe8a
SHA1

fe1a8f55d9f4858de2a663c956c0050869d4c5d6
SHA256

c888278386ad6f171af5db05ab9d892e103fedf5fefa2c859634bae3206620e8
SHA512

8b8b9173ae17ad5f7eccc5c9b182327dcd0890eeddf3947b95c6747fb9c19ba8d416436b074f52ce059240b8babb00621fa5f69ca81d9c58dcfad4701372cec9
SSDEEP

3072:IWKgct047rv7SEDBdphwrDON//TpBnVjeJgTRuCp:IWKgOLvDSEDBV1p0WFp

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 1160	1536	rundll32.exe	80
PID 1536 wrote to memory of 1160	1536	rundll32.exe	80
PID 1536 wrote to memory of 1160	1536	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\system\encvag.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\system\encvag.dll,#1
  2⤵
  PID:1160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads