fb8844d36e0b52aa5cd7a8e1983d8ba2b4b99d8fb77839515064d2c619f93add | Triage

Analysis

max time kernel
146s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
29-06-2024 09:11

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/setuphlp.dll
Size

5.7MB
MD5

f46b7526ad6b55787bf9121bfbee5d99
SHA1

34bd3ad4e745b41f41b65a2a73091aa8caf54947
SHA256

e58b63385ceededbc4df742c43f9497e1cc344e239099449a7659833c1dcdb5b
SHA512

7d0ce39300ee54aa2dc5f4863b839b6be2cb4d33a9841b5a0b6328b890c3c9c6d0d3814040864d3b671bd5b56226b35db77b5a2bc7b149acfd4871b58618b580
SSDEEP

98304:uY1+ieTAQmwDdhwTx6ok0zwY3irKyPY/itjIolWH+l55mb3/a6y:D1+iNmhw8FKCYQjrYoB

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3732 wrote to memory of 1460	3732	rundll32.exe	rundll32.exe
PID 3732 wrote to memory of 1460	3732	rundll32.exe	rundll32.exe
PID 3732 wrote to memory of 1460	3732	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\setuphlp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3732

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\setuphlp.dll,#1
2⤵
PID:1460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...