561ac9394509138348480e01174b172865a62e459b513eaf563e56383f6245d2 | Triage

Analysis

max time kernel
307s
max time network
407s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
30-06-2024 18:26

Sharing

Report Analysis Logs

General

Target

PROPAMAT/FlDTEAutomatizacion.dll
Size

90KB
MD5

85c3f90c6922470737a55041a606dd2a
SHA1

fcacecb6f0eb2fdf9d0debd4e0c4737238941dc6
SHA256

105b5213f18ae59f3a4327fa4b5548dad2fc1deaf5d35cd39024361afc7725bc
SHA512

8f0594165ae8ed7975a6417953a6310887fbc569deec6bedafc642d2711cbed078d70f23ac0bf3f19ab3cd44a7269d96a68389824ac60ce0e4aee4b9b9bbed37
SSDEEP

1536:UhBYQ1IcbhuT45zGZ2bFnnY3+a2rd0MmYv3:UhBYQ1RhuTezGcb9Y3+Nrd0Mmc

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3236 wrote to memory of 792	3236	rundll32.exe	rundll32.exe
PID 3236 wrote to memory of 792	3236	rundll32.exe	rundll32.exe
PID 3236 wrote to memory of 792	3236	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PROPAMAT\FlDTEAutomatizacion.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3236

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PROPAMAT\FlDTEAutomatizacion.dll,#1
2⤵
PID:792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...