daffaa21f751d95ca7461a21f4b49718a66fd7a2391dd0d96643ace0e9afcb43 | Triage

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 10:53

Sharing

Report Analysis Logs

General

Target

dwzhq/zjhs/iext3.dll
Size

368KB
MD5

112b14a16fe1a47a1e2adc568c1dbba3
SHA1

cc85646d59b0935bcf36c099ef92ee36f3f2650e
SHA256

c0fb4e85f957c51624edae839c371909c2672221944552a7ab32941e1aa28e7f
SHA512

248532c0c98f5c1848d25d1095974f03f486eb8b91a45de743795f684244b2e1a6e9856eec406edda8a152c621bc5453cd5829a8270ea328501d8619957f8778
SSDEEP

6144:rmnykRUKTl80I5dk8RwTY9UX0twEwZ49XDXkwG5Bj6p0Crsuci++:rmnJWNvN+KUPGxGup1Ii++

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 1016	5100	rundll32.exe	80
PID 5100 wrote to memory of 1016	5100	rundll32.exe	80
PID 5100 wrote to memory of 1016	5100	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dwzhq\zjhs\iext3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dwzhq\zjhs\iext3.dll,#1
  2⤵
  PID:1016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1016-0-0x0000000010000000-0x000000001006C000-memory.dmp

Filesize
432KB

Download