1440bc84cd404b9a3712955f77ea0ae06ca2a07b7c441ef261bc4407dd4f8877 | Triage

Analysis

max time kernel
56s
max time network
73s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
22-06-2023 13:57

Sharing

Report Analysis Logs

General

Target

e53d7ba028f3df8918c7447db0e05df8.dll
Size

54KB
MD5

e53d7ba028f3df8918c7447db0e05df8
SHA1

4de1985e2bb5401ab665301432b30137f8d9b4f2
SHA256

1440bc84cd404b9a3712955f77ea0ae06ca2a07b7c441ef261bc4407dd4f8877
SHA512

da78658c6f7f99272909590aca7f5eb55409409e9e201841a7afa011effdefd30a1e6dec31749338ffe6b509fd1798f98927eac3cc4b2e77f5a0bd4f7ee67154
SSDEEP

1536:lDm8aNg+j7Ahr26oXZzZZpAsWnBCcdGje5WcA:7aNHmq6oXZzZT+jGjeB

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4220 wrote to memory of 2148	4220	rundll32.exe	rundll32.exe
PID 4220 wrote to memory of 2148	4220	rundll32.exe	rundll32.exe
PID 4220 wrote to memory of 2148	4220	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e53d7ba028f3df8918c7447db0e05df8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4220

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e53d7ba028f3df8918c7447db0e05df8.dll,#1
2⤵
PID:2148

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2148-134-0x0000000075390000-0x00000000753A7000-memory.dmp

Filesize
92KB

Download
memory/2148-133-0x0000000075390000-0x00000000753A7000-memory.dmp

Filesize
92KB

Download