06500a1a2f152b59ceeb662d7bd5bb07175bf45a9c2528b2f6de58394ada4bc5 | Triage

Analysis

max time kernel
375s
max time network
1591s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
04-06-2023 18:56

Sharing

Report Analysis Logs

General

Target

Compiled/Misc/Plugins/DET.dll
Size

44KB
MD5

8a754803065f86c0300bf78edb47dcde
SHA1

6447eb3c0d0417ac2e12c614249c460c524785ba
SHA256

d3b98e293e1506b3f7b63e1a4b869815746468a8a000509945d43bc96eeafa08
SHA512

09143485a00cb77ea190e63f487288b1fe7684f09011073c7284ce6e15959d769ff07ec17e66b4c5590fc2fb7c24d830bb2b60f14766dddf5dc6ff86d33b2e66
SSDEEP

768:stoazFPIMuDkPTcWJsRKDl9Fh0T9E7yWIdMf:shODklr8T+7Xf

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 4160	4148	rundll32.exe	66
PID 4148 wrote to memory of 4160	4148	rundll32.exe	66
PID 4148 wrote to memory of 4160	4148	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Compiled\Misc\Plugins\DET.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Compiled\Misc\Plugins\DET.dll,#1
  2⤵
  PID:4160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads