d2cd99f2ffcad6cc11d3798ad269c5a711ac9a9bd445e940df99b65d8b095d4b | Triage

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14-07-2024 02:01

Sharing

Report Analysis Logs

General

Target

TextExtractorImpl32.dll
Size

137KB
MD5

b31cd29ddde252ee33a8f0e9e5717597
SHA1

4c9d57a30ca956818390268ba05aa1c73ce914ee
SHA256

82a56ed85159f91ce37499a615c498fa28b19d2dc3cc3c17c73f01b9a2b341ad
SHA512

c4ace3248cf854075926bf3ffe1aae415a4ff84ef0ab9de9a3f25555713ac49b8d4c3cdba70046ae260621847ff0b3e0880b4d8484f50bb2d6815592aca58b9a
SSDEEP

1536:1fAkwn/zRC9OGhvzPGShipqKdIhbM3j+VoytDQXpSaaBCv6:uk0Cz3TbM3CVPtDmpyU6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 2304	5004	rundll32.exe	84
PID 5004 wrote to memory of 2304	5004	rundll32.exe	84
PID 5004 wrote to memory of 2304	5004	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\TextExtractorImpl32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\TextExtractorImpl32.dll,#1
  2⤵
  PID:2304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads