daffaa21f751d95ca7461a21f4b49718a66fd7a2391dd0d96643ace0e9afcb43 | Triage

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 10:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dwzhq/zjhs/eCalc.dll
Size

156KB
MD5

1ce85ab756f65d822e2d3f552eaea11d
SHA1

110b9f9953bf29232a9543acec3ed904b7962ea3
SHA256

fad80c201b7b2d4c8147fcc584fb8bb0cd48802f99caa4d287e0fc9be6e6865d
SHA512

9f7d2b3027bf601128e39aee0421daecf714c9f08dc4c67fd7fa48ffacad58cb3e898716c9a88f0d148629a039eac86b1fc38e54f641f6e77a30d36ce39b7e1f
SSDEEP

3072:/iM/HJtxLkoIaa5JGBgUcsAnZ3VRBu2o28EhnGV0Ha7r/WD:3/pt5ko1hBd4nZ3Vt8EhnHH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 3132	2432	rundll32.exe	81
PID 2432 wrote to memory of 3132	2432	rundll32.exe	81
PID 2432 wrote to memory of 3132	2432	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dwzhq\zjhs\eCalc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dwzhq\zjhs\eCalc.dll,#1
  2⤵
  PID:3132

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3132-0-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download