583b51287187df514ef222f1aee18d48424a64a9f50909dd27a47ad245f863c2 | Triage

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04-07-2024 05:21

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/locate.dll
Size

15KB
MD5

3ed8f71cc67857223cad786e0c7c578e
SHA1

a4864b53ac8c0d0eaffc516f891644c935de942a
SHA256

58200fbce500184e73d8cf63bc689c157763b8a63e3d1cd62165e334e8d1596d
SHA512

7424517d42dea7a3121cc9c52d490d6d1c27df59e1e1d926cf97d3543908de78c1e384061ba76b3520cd5a7eecef83f3629b565add617193d09db09a5f882430
SSDEEP

384:e3vRxT1E9qSqCDwNnN3NLNmwJOXZRPX2qkf:e/Rx2D4N95RIXZprk

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 716	4016	rundll32.exe	80
PID 4016 wrote to memory of 716	4016	rundll32.exe	80
PID 4016 wrote to memory of 716	4016	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\locate.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\locate.dll,#1
  2⤵
  PID:716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads