bd9b6ad5174c3335f8b5ac2a5bf97b9e0795c6fab039dea099d7b53b57a82da0 | Triage

Analysis

max time kernel
92s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 00:06

Sharing

Report Analysis Logs

General

Target

Resource/Bins/xml.dll
Size

84KB
MD5

64ae9d3408769a65b262106451e3528c
SHA1

61c598443103cb9cd85d39e8ba231f5643624235
SHA256

3454ec5af915b76969b1619c2c73e7136fcbf031e4c33f3cd8cf6b8b87f9aeb9
SHA512

d6a5a1f9a653c089cd64c1aeb2f8a4270593eadfba7acd700505524e3c172ad204107f6dd6a7f28ba84a2fd85e7b04637aa9de0b038efe85525afca43024eace
SSDEEP

1536:zi67XayAvZcDFaYruTJY+R8gZaGor9SfhS05:267XayAxcDXkagMGorwfES

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 4608	4632	rundll32.exe	84
PID 4632 wrote to memory of 4608	4632	rundll32.exe	84
PID 4632 wrote to memory of 4608	4632	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Resource\Bins\xml.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Resource\Bins\xml.dll,#1
  2⤵
  PID:4608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads