abfa585a5358e658bd92d159e9f846b2950c7e300c47392283443a1bcb70fd52 | Triage

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 01:08

Sharing

Report Analysis Logs

General

Target

FLEngine_x64_Copy1.dll
Size

60.9MB
MD5

8cf300dcb6e41ee31ed6a2b58d9e26d7
SHA1

7a5dc2917942d59dedc11bc861aafd58985debb7
SHA256

abfa585a5358e658bd92d159e9f846b2950c7e300c47392283443a1bcb70fd52
SHA512

ffff2eb3f0c654f7d761978202af5d8aa64806fc6d50bc75be619ebf5e078e4fb7263aba0959d9cb941f3f515c2ed3c0cd4d5f9bab5758b82825368a975b25c7
SSDEEP

1572864:kRaFRXuG/pEqk4Ldvts4T6wH1Wq5qgZhgUB:qIXbRtLsYL8Wg+

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3760	rundll32.exe
3760	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3760	rundll32.exe
3760	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FLEngine_x64_Copy1.dll,#1
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3760-0-0x00007FFACB370000-0x00007FFACB372000-memory.dmp

Filesize
8KB

Download
memory/3760-1-0x0000000064F10000-0x0000000068D2C000-memory.dmp

Filesize
62.1MB

Download
memory/3760-2-0x0000000064F2C000-0x0000000064F2D000-memory.dmp

Filesize
4KB

Download
memory/3760-3-0x0000000064F10000-0x0000000068D2C000-memory.dmp

Filesize
62.1MB

Download