6f1cdc079812115df46d5cfc629e9ed8a9ed0d8d717de8d28bc9890b5578af4d | Triage

Analysis

max time kernel
103s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2025, 17:33

Sharing

Report Analysis Logs

General

Target

sheet rat v2.6/Stub/fds.dll
Size

106KB
MD5

a6616dc75aa8f04a473e93d36315696d
SHA1

bfaae46514424f27c1204aa7a4ddf3497a4eec4e
SHA256

97d5a331191b9361ed82c41dbdf74a0b54901d20129a0c0a0f1ecbeca5e9d1ab
SHA512

5eaf900eda2c6f494750d59b7bfa90d05374146e006ffce3b6997b9a3aedff1d0b9a6c4cffc796950b63f7c6708ad64bcaae3a517e8ee27c79e6a0bff435783f
SSDEEP

3072:6iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MnWZpt:67yDSvdoRj2up

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3136	rundll32.exe
3136	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sheet rat v2.6\Stub\fds.dll",#1
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3136-0-0x00007FF92EEAD000-0x00007FF92EEAE000-memory.dmp

Filesize
4KB

Download
memory/3136-1-0x00007FF92EE10000-0x00007FF92F005000-memory.dmp

Filesize
2.0MB

Download
memory/3136-2-0x00007FF92EE10000-0x00007FF92F005000-memory.dmp

Filesize
2.0MB

Download