1e4519b90828e71ac7b3f6e6eeb3463a02462640433e6b384206cf852931c4a4 | Triage

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16-07-2024 05:12

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/Setup.dll
Size

70KB
MD5

ceb233fa36d2f6dd6a4f4058a453d462
SHA1

c254ab2371c415d956613a2c6acb277c16d906fe
SHA256

1313e4399fcec8c6fd0928a8b9a8814cdc7dc31906bf173edf79adaf2ac2d74c
SHA512

8bbb3f3f9205cc1134484c03ce4623eb7440893707f56ffb79b36eb794d9044d90fbf953445e3c1fe47cc6aa38d4eb4acb8f180096d0ebde0e9b50fea014f734
SSDEEP

1536:AsyccnG+3ONTVIw8fe56H8GDOMVekcMHWItT:A6Ipe51NaiMHWIt

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 448	3700	rundll32.exe	83
PID 3700 wrote to memory of 448	3700	rundll32.exe	83
PID 3700 wrote to memory of 448	3700	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Setup.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Setup.dll,#1
  2⤵
  PID:448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads