c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2 | Triage

Resubmissions

19-07-2024 19:18

240719-x1c57azane 10

Analysis

max time kernel
133s
max time network
145s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
19-07-2024 19:18

Sharing

Report Analysis Logs

General

Target

vcl120.dll
Size

1.9MB
MD5

849070ebd34cbaedc525599d6c3f8914
SHA1

b0543d13f4d0cb787abdaaf1d3c9a5af17c87afa
SHA256

b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628
SHA512

f2ca685b01be9d1b77d8d924e0097ddacee7628cc1aad8a87d8b18a699558d38a7851e6cff8bb2b8ae1980824588af5c3ac75b7b4198b620144dff61611f3aeb
SSDEEP

24576:L2gt8PRUMggrgN/5tWw+eNVEXZB5SOCwhuuYY8RPyS9YEPI5yz6T:LRSf0Ww+NpPSyzYY8c8YEPI4+T

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 752 wrote to memory of 824	752	rundll32.exe	72
PID 752 wrote to memory of 824	752	rundll32.exe	72
PID 752 wrote to memory of 824	752	rundll32.exe	72

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vcl120.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\vcl120.dll,#1
  2⤵
  PID:824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads