77763018072adb9e864f06deac9ae588a7ec4ea1a112f9f82c6201d5b7973e84 | Triage

Analysis

max time kernel
134s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
04-07-2024 08:30

Sharing

Report Analysis Logs

General

Target

plugins/lua_plugin.dll
Size

365KB
MD5

da811b0828d7c06856d54b37676eedfe
SHA1

6c16b32615e8a7687431db3156166ad07aa41054
SHA256

c8639ac3bd81f8115ea5b2659a89b536745a2e9521f7e605df0848d0427f5094
SHA512

d6f91d5beda593060e72da4a806c0c43516ac2a44cef51640ccba0f727d5e2845253039cadf0e55ed3e6d97481419a72c0e2b092aafd52b38a1ec3a25eb99162
SSDEEP

6144:x65bwfM76Tqeo8FnMLFF/wvemmtQTT/dMkYAOo+JzxyKu:/HrFnM5F/5mTmkYNtju

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 4844	4544	rundll32.exe	84
PID 4544 wrote to memory of 4844	4544	rundll32.exe	84
PID 4544 wrote to memory of 4844	4544	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\plugins\lua_plugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\plugins\lua_plugin.dll,#1
  2⤵
  PID:4844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads