78e964883e5c4bf9e1e49eb1e2df92b3bc69a7a8bca1dd9fd828a8c7fc11c502 | Triage

Analysis

max time kernel
437s
max time network
1159s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
11/07/2024, 17:45

Sharing

Report Analysis Logs

General

Target

qemu/libusb0.dll
Size

41KB
MD5

989f5b2fc89de3557307b703ce6a865d
SHA1

4d44ea5b13c438fedf38053b29cc8522247a13a7
SHA256

09a5f4f11a46f5b03d971a99fd885504cabb39604e68727fbfa0d3fd97efb55d
SHA512

569a3b07cf22313bde03c66de2caec95fe8a100077d1f561faaa43b06db327bf0cb425cf0ce435c2135de1abc293c791eb144442ba462e4b33bd80372f31159b
SSDEEP

768:NP4DHMAWcAqOW+9WjJVMdOoC3jNkwp68BM6sBly:NHAWPdWww/QTCBM1Bly

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 1680	2688	rundll32.exe	81
PID 2688 wrote to memory of 1680	2688	rundll32.exe	81
PID 2688 wrote to memory of 1680	2688	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\qemu\libusb0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\qemu\libusb0.dll,#1
  2⤵
  PID:1680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads