125f296c4f5617819ff56818e3b6c6e2cc463a994e7061a8a5fc58dd189ea3e3 | Triage

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2024 01:40

Sharing

Report Analysis Logs

General

Target

psapi.dll
Size

14KB
MD5

2959bc8100891018ac69ebd55b1becc3
SHA1

7ab48be94f3e792f9ef34e8df4756235e81d526a
SHA256

1b9491364db5af8c6c64c91858d1ac74461d2931a10a5f7e46f1679dbbd7e950
SHA512

38e6e6dc98cdb538a3736dd62cea57fb81d1aec27142f4720d656ab30ab94aae0a8fba6033be292dc1ea428f61473bfe24e2226120f3e6eb65f81e1f6a2ee2e8
SSDEEP

384:G1ncyubrbVlgocG1FAt7PyrdORoGDrbgL5ZWZkYWO:GOyyvVlV1FAt7PsdODbgLp

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 3020	3388	rundll32.exe	84
PID 3388 wrote to memory of 3020	3388	rundll32.exe	84
PID 3388 wrote to memory of 3020	3388	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\psapi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\psapi.dll,#1
  2⤵
  PID:3020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads