60053fc2289d803a6b20728e2fccf49e179298aa55cf2c1c202d8715d685cc1c | Triage

Analysis

max time kernel
93s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14-07-2024 14:53

Sharing

Report Analysis Logs

General

Target

nm2ytzbbjewqct.dll
Size

10KB
MD5

1ca0579358b764f49d199fd22a0f569f
SHA1

15377138e9a7a06ebeece6782edd3f3aa90ba917
SHA256

5520b6a010887b22921e66e0bc384ce320db3e48ae92e0a7654cb0354d23a57f
SHA512

9e0f71ebafd9b086ca65acaafedbdcc03ac8942d23df6e9d37244c739fbc0b964b33a2c666711cd1bde5cfa0f7778146227d5a89816de5718e381743aa36395e
SSDEEP

192:3zA+ViwUnzNFMXkqD5uXvUcdrIKq2pA98WrZjod0pS3Sy3:CankvUcOJwq8Wdjo2pYd

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3932	rundll32.exe
3932	rundll32.exe
3932	rundll32.exe
3932	rundll32.exe
3932	rundll32.exe
3932	rundll32.exe
3932	rundll32.exe
3932	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 3932	2744	rundll32.exe	83
PID 2744 wrote to memory of 3932	2744	rundll32.exe	83
PID 2744 wrote to memory of 3932	2744	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\nm2ytzbbjewqct.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\nm2ytzbbjewqct.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3932-0-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download