4660227f0b71547871b4f33ff2b92b55b2563138c257f0c361270587b2a420ef | Triage

Analysis

max time kernel
135s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2023 08:56

Sharing

Report Analysis Logs

General

Target

3727880831612b8461cf81cc4e05d2a3.dll
Size

102KB
MD5

3727880831612b8461cf81cc4e05d2a3
SHA1

cba779d2e241202cb36bc1cc508d281dde503a27
SHA256

4660227f0b71547871b4f33ff2b92b55b2563138c257f0c361270587b2a420ef
SHA512

8d7959c13672d5c17535aaa5056e35d515cd918d0196e61c842bd10a1664b4abc9a71977494b14f813bd6d912828d41eb01d8ca021f0666ddadec0072d6930f6
SSDEEP

3072:jYHZ5o8D+sjrW2sosmrtuQRYKr77BUJYW0Z:jcDoBkPsituQR5vW0Z

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1624 wrote to memory of 3752	1624	rundll32.exe	rundll32.exe
PID 1624 wrote to memory of 3752	1624	rundll32.exe	rundll32.exe
PID 1624 wrote to memory of 3752	1624	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3727880831612b8461cf81cc4e05d2a3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1624

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3727880831612b8461cf81cc4e05d2a3.dll,#1
2⤵
PID:3752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...