Analysis

  • max time kernel
    136s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/10/2024, 00:31

General

  • Target

    monsterpk.dll

  • Size

    251KB

  • MD5

    59206d3baf1d2bd175867f7bbf47fea7

  • SHA1

    e823064b0586e44f550e066926e19a20c69b388a

  • SHA256

    6ffdab7f2d49d1e24e7f3b12c82869c8ec17ba412bf94534029ea0adc0c9cf16

  • SHA512

    1ffc5f75df7b939ecbab489f7f252a955d753d8f7bec7096a8597a10f23e2eca0834ce6e45b33835ff858533b4dafe62b6396ecd502b11490237d4c287fc3d6a

  • SSDEEP

    6144:YHJIlEajXCYu83c8qLCVKJEv8xvJFF1Vp+0CBwc:milEav3czMFWp+04w

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\monsterpk.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4272
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\monsterpk.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3776

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads