1b3f39e0d2c736b7dbbc037931820f690698b2d4caa903abd49a8104375f0def | Triage

Analysis

max time kernel
211s
max time network
225s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01-04-2023 07:40

Sharing

Report Analysis Logs

General

Target

1/borlndmm.dll
Size

47KB
MD5

e3fcf256b4683ab92703842985b5e725
SHA1

0cd88d6b7fea697aef161f861861ecf8bdd4586d
SHA256

ca1f509d6779bc005f332027d50e9bafa952bcf970953593a9566973b4122759
SHA512

50d96e1ef2d8e941ad15427359600d35ef7cc879da9b14dc0b6228ddc375f5743e2c3a1ee239fd4f51261c4f1bc95d8a044abfcb052626fb86edcc54e7e74985
SSDEEP

768:Bu2xqT9w4SsJwUIgOmoowURkYAwtVo3c8EL+:BuD643Jd5Omvs39

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 548 wrote to memory of 2004	548	rundll32.exe	rundll32.exe
PID 548 wrote to memory of 2004	548	rundll32.exe	rundll32.exe
PID 548 wrote to memory of 2004	548	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1\borlndmm.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1\borlndmm.dll,#1
  2⤵
  PID:2004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads