43dd818938f2a189ae43dcaffa558ad39d518aa60ac096f0cdc0f1c35677a249 | Triage

Analysis

max time kernel
96s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 18:35

Sharing

Report Analysis Logs

General

Target

Icons/proto_YAHOO.dll
Size

22KB
MD5

45e7ad79a3c589cc66372657483795f7
SHA1

3db3a7f2d073d2454ee2a363f64507eff86266d3
SHA256

7e765564094de34383b29161ec0701d2cf383e07f5a5f296d95e957ae90b72d7
SHA512

9d326143283ff7b89b7cd8df96de5d057c12376db540e57b70de41876320ab284e4639a915fc533ecfa5f07ec441b191d31cb682a09e40c6d34eeecd8b9823f9
SSDEEP

384:PR5k9STI3s3gQ3BxOt06lyx2VngngN2fHUwyRn:PLk9SMDoBxOtrc2pN0HyR

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 4600	2340	rundll32.exe	85
PID 2340 wrote to memory of 4600	2340	rundll32.exe	85
PID 2340 wrote to memory of 4600	2340	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Icons\proto_YAHOO.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Icons\proto_YAHOO.dll,#1
  2⤵
  PID:4600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads