d910030e1f0562ef78edc8f82d37e1d47ba9dbb7048086d857a1a633c24eb994 | Triage

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 18:05

Sharing

Report Analysis Logs

General

Target

xptools690/WinRing0.dll
Size

64KB
MD5

3efa8f1865595ebe1dd415025bf17d8f
SHA1

c37f9c5fc06bd1ee8a0a7694f378c0cdd2eb4484
SHA256

8edb4338883cb12d730ea1827c8e232b4a1562e207c5af26b0d8d86e4b3f2269
SHA512

49b6c8a4005f4f2b61e57d373bc74ffef715d174ed891a73502e2cc19f21c59293188cda364fe86b2bdcd1dc9d97562cf8b73449ce715ecf285c964628cd5764
SSDEEP

768:hRPlqAVzcRDoomqfLYwwvI+Ps8qyOTtvPPzGVojF:jPlA0ogw+PiZtXPzNj

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 3212	2192	rundll32.exe	84
PID 2192 wrote to memory of 3212	2192	rundll32.exe	84
PID 2192 wrote to memory of 3212	2192	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\xptools690\WinRing0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\xptools690\WinRing0.dll,#1
  2⤵
  PID:3212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads