ff4bacc28cf6eb2e123bb9ef5fc818ace9f83c3c398d2d9ab78b80c224cdb7ba | Triage

Analysis

max time kernel
140s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 23:47

Sharing

Report Analysis Logs

General

Target

GMS-WinDev.dll
Size

85KB
MD5

fb1e3cb9d7fff99956c96baf742dbf6f
SHA1

65777480cd33d413bcee7bef89a2be8827bc0b29
SHA256

fc86c4f3e9bcb57928cab5ebc43c99093b78c97246d400447aa1b4a5bd524266
SHA512

512b60c28de4e0d591d72086009396439d1f7635c3c2aab04d0a30398b0f1db8dc16c4baf1ccca32233783482aff3bd39bd8e6888c49ec715bda3c1895a9e136
SSDEEP

1536:VPU8NF9DVMY3UWuFw1LLzhuw0+XA3tJqUsWiJcdAGCKyAP8NqM:Xqy3uw1LLtnKNADrAP8NH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 4920	3792	rundll32.exe	83
PID 3792 wrote to memory of 4920	3792	rundll32.exe	83
PID 3792 wrote to memory of 4920	3792	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GMS-WinDev.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\GMS-WinDev.dll,#1
  2⤵
  PID:4920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads