4cbad2109bbec9d2e1d2110d984422b0da544099195dc116d1beb868a32782ea | Triage

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2023, 18:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Binario.dll.bin.dll
Size

1.3MB
MD5

88bc34c61540d8ea732fade14d78a79c
SHA1

0a8ab90ca0dc1ec4ab9296e1067a695d18955b1d
SHA256

4cbad2109bbec9d2e1d2110d984422b0da544099195dc116d1beb868a32782ea
SHA512

0a5b188c33c58cf8984283dc16c82a95bf31c945771ddb9540f1d06d04709124f0151436147d85079a0d49ecbcf7a13765d2365decbd127e82b5204cfbc0d3d7
SSDEEP

24576:t4P8m43pNwrrbIaKrSpUZlRmSPs9ySxxw7a+FEDa/0MO:B72pOlRmKs9ySnwRT0Z

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 4416	620	rundll32.exe	85
PID 620 wrote to memory of 4416	620	rundll32.exe	85
PID 620 wrote to memory of 4416	620	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Binario.dll.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:620
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Binario.dll.bin.dll,#1
  2⤵
  PID:4416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4416-0-0x0000000074C30000-0x0000000074D91000-memory.dmp

Filesize
1.4MB

Download