93d1df69e244cae0eeec8a6422e70fa404a5227907e93cdb06eec97c5f4f155a | Triage

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2023 14:13

Sharing

Report Analysis Logs

General

Target

bb38811767f42635a13b56afd5bbace7.dll
Size

152KB
MD5

bb38811767f42635a13b56afd5bbace7
SHA1

291f9b8b1075f0b97c7bdeb1e27a4358a5d08e96
SHA256

93d1df69e244cae0eeec8a6422e70fa404a5227907e93cdb06eec97c5f4f155a
SHA512

5ae6111bdaa1741ff318e8fe44f89125d610f902b46660a8c02c76132d8c9fd8b4d48503d1dfb86476e0a1347d3d6b39446d86f7ab5d30c9d7d083dd3943aebb
SSDEEP

3072:3hSOaj9fCvequz+4dHZtRMRmjLygGyH21qFo9eN:xJqR+4VZt2RmnyBH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 5108	1292	rundll32.exe	88
PID 1292 wrote to memory of 5108	1292	rundll32.exe	88
PID 1292 wrote to memory of 5108	1292	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb38811767f42635a13b56afd5bbace7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb38811767f42635a13b56afd5bbace7.dll,#1
  2⤵
  PID:5108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads