bd9b6ad5174c3335f8b5ac2a5bf97b9e0795c6fab039dea099d7b53b57a82da0 | Triage

Analysis

max time kernel
94s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 00:06

Sharing

Report Analysis Logs

General

Target

Resource/Bins/GmAPI.dll
Size

125KB
MD5

58a9607cfaf3c8a6883ddebf93e0fe1f
SHA1

dd1095643d0d6530305f360b35741fcac0e9b085
SHA256

05596201bc9aade4c1facb441867d105c93a378803fd9b90bd2c70bc7a0164ca
SHA512

2e98e04965122380ac64e3d3a0b2b5328f52ead334f701576e12220aa8da37de61e913f354db3e108c4007c92a982ec6aa7b97b1d9c88859d4db76ae3d6346ab
SSDEEP

3072:Iiq7vl+04lXR8eBvJpBRFzlN4PZvBq/s6IdRUFcV:devlyvpBRF74PvspIbm0

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2460	2988	rundll32.exe	84
PID 2988 wrote to memory of 2460	2988	rundll32.exe	84
PID 2988 wrote to memory of 2460	2988	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Resource\Bins\GmAPI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Resource\Bins\GmAPI.dll,#1
  2⤵
  PID:2460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2460-0-0x0000000010000000-0x0000000010050000-memory.dmp

Filesize
320KB

Download
memory/2460-1-0x0000000000D10000-0x0000000000D12000-memory.dmp

Filesize
8KB

Download