d8886a5bed580b5568d0868e50018692adb7a6b9ba8fa650347aca3473187cc0 | Triage

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2023 08:32

Sharing

Report Analysis Logs

General

Target

7c49606bce11be51d220ca774b337c77.dll
Size

102KB
MD5

7c49606bce11be51d220ca774b337c77
SHA1

15d93aa30a50f0f0c0c8fba9c23797faa7ca1efa
SHA256

d8886a5bed580b5568d0868e50018692adb7a6b9ba8fa650347aca3473187cc0
SHA512

decb1fea254434bd261be4adb2f94c350a47adb171c319a1cfee01ee18f686e8ed0deb8a90b312cba63cad5799a9f8ae2e54911a41c3f6b89f56d034e1a4132a
SSDEEP

3072:HwTxt8T+Mz7G2MosmfNuQR/SrT7BUFYW0Z:HQ7R0PseNuQREvW0Z

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2060 wrote to memory of 3804	2060	rundll32.exe	rundll32.exe
PID 2060 wrote to memory of 3804	2060	rundll32.exe	rundll32.exe
PID 2060 wrote to memory of 3804	2060	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7c49606bce11be51d220ca774b337c77.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2060

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7c49606bce11be51d220ca774b337c77.dll,#1
2⤵
PID:3804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads