d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd | Triage

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
31-05-2024 18:55

Sharing

Report Analysis Logs

General

Target

enigma_ide.dll
Size

18KB
MD5

b7b200d4c9716ea98858570e9cb53658
SHA1

19d145b80a7367b4845f1cc1528b9238d9836add
SHA256

e2ee71162fa60d278b8c833a4487e33fcef771e485a350f3e9fb2365909f214e
SHA512

5b26ebcabd2dcf7350444f781d1b6d81e12aa4c4fd3aa101e0978f57146f2fd9a532daaa4e3d83ed828ae6afc56cbd35db2b2c26c84081ecfd148b5f3a5611f6
SSDEEP

384:uezhZEAyI91y8yu9pl0SMPAzVTZgcFhKUdx5:7c8yu/uQNZgcF/d

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4640 wrote to memory of 704	4640	rundll32.exe	rundll32.exe
PID 4640 wrote to memory of 704	4640	rundll32.exe	rundll32.exe
PID 4640 wrote to memory of 704	4640	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\enigma_ide.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4640

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\enigma_ide.dll,#1
2⤵
PID:704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...