34c35e5e18354f9e459e792a3f8bb40af5b18787f0461078ba563b5d49aa6292 | Triage

Analysis

max time kernel
139s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 22:32

Sharing

Report Analysis Logs

General

Target

Clanwar1.0/ConfigMgr.dll
Size

144KB
MD5

c5c49c0b7abb458338aa8a6e8a6ebe5d
SHA1

e35a2b917ed5438e02452a930602967e4b34dd91
SHA256

eaf9247849850020c265f5d32506f396596c3f3ed92a4e53537bcb19c9308bbb
SHA512

e12c856352ab6afaa8ef4d90a788acd70f256992663f94afc52dfed9f8377fb3518d305bc37ad0cde1422b69383d962b3b865bb275d5b98cafb5f286f5aae9e7
SSDEEP

3072:SIpX5wz3hm4OVFXd5P18Adieps+I/XpmRBOKcal17Kt:S6MC3NVZiepk5mRBOKcb

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 2720	4648	rundll32.exe	85
PID 4648 wrote to memory of 2720	4648	rundll32.exe	85
PID 4648 wrote to memory of 2720	4648	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Clanwar1.0\ConfigMgr.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Clanwar1.0\ConfigMgr.dll,#1
  2⤵
  PID:2720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads