149325fa77bca2c93ffc99897dd4f971a8cdb9a59f37161bd9e4067c42e822af | Triage

Analysis

max time kernel
144s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 23:22

Sharing

Report Analysis Logs

General

Target

192883c0813753fb474caf243b772aaf.dll
Size

526KB
MD5

192883c0813753fb474caf243b772aaf
SHA1

997e740f2c79eaa4830c97150a1f1e71f907240e
SHA256

149325fa77bca2c93ffc99897dd4f971a8cdb9a59f37161bd9e4067c42e822af
SHA512

c263e9e2cb21106c06c8283c7f22c47b98c56ccdb5e5922493ae53651bb075c29a4a95f5fa5f42967050fb31bc70a21c7ce3525e4f1d51d796383cbe5b33d098
SSDEEP

12288:w4Ggs0lu2BpLiPwlUfIKKuioD4LP22dwfw93PB0:w4pllsQUfIKKuZAP24W

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 4724	220	rundll32.exe	87
PID 220 wrote to memory of 4724	220	rundll32.exe	87
PID 220 wrote to memory of 4724	220	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\192883c0813753fb474caf243b772aaf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\192883c0813753fb474caf243b772aaf.dll,#1
  2⤵
  PID:4724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads