561ac9394509138348480e01174b172865a62e459b513eaf563e56383f6245d2 | Triage

Analysis

max time kernel
309s
max time network
401s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
30-06-2024 18:26

Sharing

Report Analysis Logs

General

Target

PROPAMAT/FlFramework.dll
Size

139KB
MD5

e659959307ac62ef55124dab2c890d24
SHA1

0148d880386b7ec72e6f55d047dc842578268936
SHA256

840af7a0df83c1bfb81119a6a617f57c7dfdcf185d62a4f2ab7ef6d3a7028a6e
SHA512

2cd87d87a8ce40990b744df6cb6eea871293742723116e11954eabf83661d955b0aba615868d43d5a33b70fe6ddd7ce4dea3b24ee895118fce10e12e20b4ed4e
SSDEEP

3072:SB7EiOJXfOJaMQME+GO3Obxu6ulpTpUlsA:SB7EisfqQME+GoB6ulpTpU

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1472 wrote to memory of 3348	1472	rundll32.exe	rundll32.exe
PID 1472 wrote to memory of 3348	1472	rundll32.exe	rundll32.exe
PID 1472 wrote to memory of 3348	1472	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PROPAMAT\FlFramework.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1472

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PROPAMAT\FlFramework.dll,#1
2⤵
PID:3348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...