daffaa21f751d95ca7461a21f4b49718a66fd7a2391dd0d96643ace0e9afcb43 | Triage

Analysis

max time kernel
134s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 10:53

Sharing

Report Analysis Logs

General

Target

dwzhq/zjhs/iext2.dll
Size

460KB
MD5

e496292118f4bfbc8bcf84cc5f6dbedd
SHA1

3e31752413cace61fba648d03d469a0d15504630
SHA256

e882fe604d130f507e9674ebeb179637b0c9829c210dd67a33012d6f1e9ff752
SHA512

9f57f3218b74b288ff4b673a34dd94eb2f7f559f9e099cacd60f2c997047cd6314de974113eaf5afea6de72791c420b54d8088da86ac001caa4b48245bf88bf2
SSDEEP

12288:SKLXVEfRtF+NoQO1hYIvF+Y9S1CYUSQC4E:HbOJP+NCWxQCF

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 4608	2484	rundll32.exe	87
PID 2484 wrote to memory of 4608	2484	rundll32.exe	87
PID 2484 wrote to memory of 4608	2484	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dwzhq\zjhs\iext2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dwzhq\zjhs\iext2.dll,#1
  2⤵
  PID:4608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4608-0-0x0000000010000000-0x0000000010083000-memory.dmp

Filesize
524KB

Download