8df045a1d8b3b22bd730b71bc64c937f86e11e10fc71fb6f1450662799b72486 | Triage

Analysis

max time kernel
215s
max time network
225s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2023 23:38

Sharing

Report Analysis Logs

General

Target

1a2996a2c196dddaf043b62ce6c1fd94.dll
Size

50KB
MD5

1a2996a2c196dddaf043b62ce6c1fd94
SHA1

6d0267f9af140542acce1cf950d1e7cbcb27c59e
SHA256

8df045a1d8b3b22bd730b71bc64c937f86e11e10fc71fb6f1450662799b72486
SHA512

460cc58a6433becd6d26fe33bf7372595b323c6c57f4aaea5b2ced8a27892ac295e0ce7460bf3ffcbd62e0d43fcb31cd5ea9477bfa8968eb54125d41f3f5455b
SSDEEP

768:IQWvgQYLCPJiSXj3PLle9UCvK1u6rkR7rH1db:CJYLs8GHle9ZS4dR7b

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 1216	4916	rundll32.exe	88
PID 4916 wrote to memory of 1216	4916	rundll32.exe	88
PID 4916 wrote to memory of 1216	4916	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a2996a2c196dddaf043b62ce6c1fd94.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a2996a2c196dddaf043b62ce6c1fd94.dll,#1
  2⤵
  PID:1216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1216-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1216-1-0x00000000005E0000-0x00000000005EA000-memory.dmp

Filesize
40KB

Download