21cc0f9e75b41d97d99bef929b18626b0653cb19e26d66ade43f114ef7fc95d0 | Triage

Analysis

max time kernel
139s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 15:36

Sharing

Report Analysis Logs

General

Target

03f8c67d22923198658c77ed7f2125bf.dll
Size

66KB
MD5

03f8c67d22923198658c77ed7f2125bf
SHA1

ce8558b930c4e99404345c39a8a9643aeb74df13
SHA256

21cc0f9e75b41d97d99bef929b18626b0653cb19e26d66ade43f114ef7fc95d0
SHA512

14e0db9b0c35fe0e58764bb1c8ed17c7b707cb3163f641d15423a1caa6e27fd5d49fb3e3012e67dc511ad52328985330161015a235fb866619fdc10fcac21577
SSDEEP

1536:BfQAl+7ovOahJbZ2K36LmyGY7gJB3UJLAYaMWPCk:dQAl+pEJb4DnED3UyYa3Ck

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 568	2476	rundll32.exe	14
PID 2476 wrote to memory of 568	2476	rundll32.exe	14
PID 2476 wrote to memory of 568	2476	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\03f8c67d22923198658c77ed7f2125bf.dll,#1
1⤵
PID:568

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\03f8c67d22923198658c77ed7f2125bf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/568-1-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

Filesize
4KB

Download
memory/568-0-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download