bd596b7c49cb63c8b73a815c4eceb0149ccaee34d124dc9cf5e5c5304dde7a5f | Triage

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 02:53

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/mIRC.dll
Size

23KB
MD5

37951d5d14c5b7d41899bfe3bcf965b8
SHA1

3f429c58188753ce59ef159785c468790955a821
SHA256

41e306c9396301950b4ed6e961736f70514fa57c9d872da11416e09fd0af50ee
SHA512

ba714c83eb2b89e353344b45949090e367b53ab04251ed316c43af60340e3f0d47323b15f4f9929c48910ac18e78178fb4f4dfa1f366ffbcdb6186eb3df15027
SSDEEP

384:w9OMMDa6kKNvS9ig5R6bTEsfvdFA0ku8i8oo4uGPGc5lT:wjM+Ng3Es3dFAdiD1Oc5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 1532	1400	rundll32.exe	84
PID 1400 wrote to memory of 1532	1400	rundll32.exe	84
PID 1400 wrote to memory of 1532	1400	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\mIRC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\mIRC.dll,#1
  2⤵
  PID:1532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads