f0312bb0e825e5786d08e93f63c1880fbae8f8cbc45f0955e2ea74becc3ef27e | Triage

Analysis

max time kernel
93s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 11:31

Sharing

Report Analysis Logs

General

Target

plugins/GenOEP.dll
Size

5KB
MD5

5f70e720b000b649fc3adb34304424a6
SHA1

9a5ed7250f03dcd86d568b2ed098da0d787a393e
SHA256

6625f4d4d93d5fb3c6c91152e3b9e4f4fecd824dab6dbfcabca22b97b98072a1
SHA512

c38d204afd1db72cc72afbcb2c492fbba5b2b833e3ad621412dc10ebd4e3ebd6ff940adcfcd0c47bf388414ae168b4c7b682949c78a8deaac4530f2048eb1a1f
SSDEEP

96:fozl7CLEiudJnh77yw1mghgCgUgkKgARLO/EIkfGVmB:2hCLEiuTnh7pHVz4RCcBfG

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 860 wrote to memory of 5100	860	rundll32.exe	83
PID 860 wrote to memory of 5100	860	rundll32.exe	83
PID 860 wrote to memory of 5100	860	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\plugins\GenOEP.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\plugins\GenOEP.dll,#1
  2⤵
  PID:5100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5100-0-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download
memory/5100-1-0x0000000010001000-0x0000000010002000-memory.dmp

Filesize
4KB

Download