ddaa8930856619d828e7296684577e05ac655eafe657997cfae6463c03bb544a | Triage

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 16:21

Sharing

Report Analysis Logs

General

Target

0567d2dd52a9470417a9f60e9f962a27.dll
Size

44KB
MD5

0567d2dd52a9470417a9f60e9f962a27
SHA1

6c9742e35f5e26831982de93cf64e3a6d12c81c8
SHA256

ddaa8930856619d828e7296684577e05ac655eafe657997cfae6463c03bb544a
SHA512

61e3cb03032287f398c6049a03a7a508830bcfb868b89741ea8e7119c99d1a827856fe1b63eb8e6b1b0f684cce0c740a74adbec83b12f2d92d80e20cc230443c
SSDEEP

768:lcsT+vcCmKwC7+4tAaHWieD16Nj48lbjxDCNalQe:lcKaDwC7+Lm14SxDKe

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 4200	1504	rundll32.exe	87
PID 1504 wrote to memory of 4200	1504	rundll32.exe	87
PID 1504 wrote to memory of 4200	1504	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0567d2dd52a9470417a9f60e9f962a27.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0567d2dd52a9470417a9f60e9f962a27.dll,#1
  2⤵
  PID:4200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads