39ebf996ee711ba43b36772c745f82eb32e9cd70f85c31ce547dd9f0d52ddb50 | Triage

Analysis

max time kernel
170s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 23:12

Sharing

Report Analysis Logs

General

Target

1878dcb96fab72d37ac4cfa290b578a2.dll
Size

452KB
MD5

1878dcb96fab72d37ac4cfa290b578a2
SHA1

14f348357af8e11f5b759631c98c7816e6f7e292
SHA256

39ebf996ee711ba43b36772c745f82eb32e9cd70f85c31ce547dd9f0d52ddb50
SHA512

30156519624b982867c2aac8aee7a71d0206b6bba312e7fd1142d5be228ca7eaeca7c902ca2fe84bef96452d8f23eb4fbc165291a80f4638949c475036f72ff3
SSDEEP

12288:OcFGNgk8c6elKiks8hEkpdYxx7W0fllchLMT:OcE6elkZExE0fl+w

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 4548	3648	rundll32.exe	88
PID 3648 wrote to memory of 4548	3648	rundll32.exe	88
PID 3648 wrote to memory of 4548	3648	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1878dcb96fab72d37ac4cfa290b578a2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1878dcb96fab72d37ac4cfa290b578a2.dll,#1
  2⤵
  PID:4548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4548-0-0x000000001E200000-0x000000001E27B000-memory.dmp

Filesize
492KB

Download