f032591ff92ac9f36254adcab78f85d13f6c7559ecd0e7cb782d3c49db70ca1b | Triage

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22-07-2024 23:56

Sharing

Report Analysis Logs

General

Target

nEO iMAGING/borlndmm.dll
Size

22KB
MD5

232966bf4e5f15491481ac3958131a21
SHA1

3a8f6cc882e354dca5c1a570faeaad7ebe6adf00
SHA256

8af7c734698d544bff3985c973acd680cc4eeca4dc69b3b87f6a177e3aae3abe
SHA512

4845d41979116cfaf4bcf7e7c6005cb0f4082eb3f6fc45468a8504bd08df0ec2ac59f4d547b84d4c7e0602a064b689438dbe6caba73990e3333af49cad6f95cb
SSDEEP

384:ct9kMq7qiRQW9UzLs91i45ZWpDahlzuIqo0EzrEKAz+vw7:fMq7qOQWWzIhI+hYIqvE3Ez+c

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3652 wrote to memory of 2688	3652	rundll32.exe	86
PID 3652 wrote to memory of 2688	3652	rundll32.exe	86
PID 3652 wrote to memory of 2688	3652	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\nEO iMAGING\borlndmm.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\nEO iMAGING\borlndmm.dll",#1
  2⤵
  PID:2688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads