99e8f59ecf8ab4d3a05fdc545655b033afd7df2585b79021ca3eca974f0aa955 | Triage

Analysis

max time kernel
140s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
05/08/2023, 16:01

Sharing

Report Analysis Logs

General

Target

calc.dll
Size

16KB
MD5

2d28c41650790b2e21ef9d9b79ac35fb
SHA1

977fc59efaf1df55690dd00337461da060f628c2
SHA256

99e8f59ecf8ab4d3a05fdc545655b033afd7df2585b79021ca3eca974f0aa955
SHA512

c0855cea54772f62379ef31730546dcabe78691ce894c3467cc7fedc55d59eb6476933054e3e90448bb59fb86011664c6be9273c1e28cead5830439cf5221980
SSDEEP

192:lnUf7Wpgwu2W1ZyV6OJJ7/aK29q6nPJHjO+fEtCt0OEeNoRLd40fFbr/pTUw0mUZ:qPwu2EZyYTK2PJHjWtCme4LDVzb

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 1936	640	rundll32.exe	81
PID 640 wrote to memory of 1936	640	rundll32.exe	81
PID 640 wrote to memory of 1936	640	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\calc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\calc.dll,#1
  2⤵
  PID:1936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads