561ac9394509138348480e01174b172865a62e459b513eaf563e56383f6245d2 | Triage

Analysis

max time kernel
512s
max time network
534s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
30-06-2024 18:26

Sharing

Report Analysis Logs

General

Target

PROPAMAT/E_Mail.dll
Size

69KB
MD5

53a8d62ad1bbe249f8d8659b3db3473f
SHA1

b3bdc57457faa3647b3b24738684f80eb1b8ba0b
SHA256

00f664e654cf4f580fd1bad544f4434b6dd1697f550d3689b49c5974ac3354e1
SHA512

e50128f12c62f40ff023a1de2d87310a255d2ba2f9a3b65ac2025470e241c6804887bb374ca37cc3eb7981b3061bbb68ee9e87867669fdd12520a1db933ce140
SSDEEP

1536:G9HCV0OX6tWDEJGDgeJEPizvpirq7A+9Uoyo0UyJt3ph8XyA3:GYz6GDgeJEcorloyo0UyJt3phO

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3964 wrote to memory of 4016	3964	rundll32.exe	rundll32.exe
PID 3964 wrote to memory of 4016	3964	rundll32.exe	rundll32.exe
PID 3964 wrote to memory of 4016	3964	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PROPAMAT\E_Mail.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3964

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PROPAMAT\E_Mail.dll,#1
2⤵
PID:4016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...