e1270a2d99328076084583de22d4f8e55dd45c76842560ade5c4775f94c481db | Triage

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 22:28

Sharing

Report Analysis Logs

General

Target

4021a582b722213f17d2952d9cb3f60e.dll
Size

127KB
MD5

4021a582b722213f17d2952d9cb3f60e
SHA1

7614c31c6aecab280e8b58f96b7c5d00d714ff92
SHA256

e1270a2d99328076084583de22d4f8e55dd45c76842560ade5c4775f94c481db
SHA512

ed27fd49e0dda264b2ed0219bbcca440633eb814fa5612c9431247c78811bd768b688986ccb681ef209af8d8f266b87055951b329f533e1ae085948e14e021e6
SSDEEP

3072:FuVsLs7EEjLpqHv+9GT7RQ9sSgC5GB/dg:FuKLsrpjVGw

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 436	4364	rundll32.exe	89
PID 4364 wrote to memory of 436	4364	rundll32.exe	89
PID 4364 wrote to memory of 436	4364	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4021a582b722213f17d2952d9cb3f60e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4021a582b722213f17d2952d9cb3f60e.dll,#1
  2⤵
  PID:436

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads