5642d1ae53a6dba7a084d997ca76305e40b897e90b1f7a932e08d980ea1a2ba0 | Triage

Analysis

max time kernel
153s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
25/04/2023, 14:05

Sharing

Report Analysis Logs

General

Target

portable/_hashlib.dll
Size

993KB
MD5

b1dbd52e5da083e5b5613a2b4c17a4ef
SHA1

0ed87f9e0b572f88e102739daab54db03fade416
SHA256

fa57bf3173f2d636984305401c06f1618b8119fea2c311d1173566ea236fa0c6
SHA512

dbe14802ff53e8fb9f35baa1c1bd0dc55c1073e0f96b59b5cc3783760e23c645cd453a39b2b4d0ab79ee871ba1cb81154a4cf5c54b67dde7ea14008d72dd2cae
SSDEEP

24576:oQhOEvtEWiRLcoTUIEPmUsOE0iUadcBoO0kAB05bSpUYPGDqul:1lE74EUXrZ6O0kXSpUhDqul

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 4724	3012	rundll32.exe	83
PID 3012 wrote to memory of 4724	3012	rundll32.exe	83
PID 3012 wrote to memory of 4724	3012	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\portable\_hashlib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\portable\_hashlib.dll,#1
  2⤵
  PID:4724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads