f3ea29a2811f839ca72b82e3ccf19bdb83ec25818cbe16e61a6f2f152436a03d | Triage

Analysis

max time kernel
95s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 06:26

Sharing

Report Analysis Logs

General

Target

edxSilkroadDll5.dll
Size

289KB
MD5

51ed8a28b1da0e68c3bbcf52815e5e2f
SHA1

c1f42a418b2e703565f0ab9fa2e2bd7618daeb4c
SHA256

b755bcace4dfe31f49a202e38eed93e3200faee81c501b946cdee11302ea7500
SHA512

4f11287726f3513234b822cd77a0eee625c746dc08e23f77120eed1ecacfedac60d51a27fac5b1355bfc34ab266c09b3f54521a90c225fcd0489be5b99187d4f
SSDEEP

6144:qZGrCQgTD8wtm7V9TDE/2708z0cN0MKA:qIr04uS9U//8zWA

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 1048	4064	rundll32.exe	84
PID 4064 wrote to memory of 1048	4064	rundll32.exe	84
PID 4064 wrote to memory of 1048	4064	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\edxSilkroadDll5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\edxSilkroadDll5.dll,#1
  2⤵
  PID:1048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1048-0-0x00000000004F0000-0x0000000000504000-memory.dmp

Filesize
80KB

Download