2398a099fef991fd9cb46ff5cfb53bf7b3d0c9f371327dfbb8087d4d17c65889 | Triage

Analysis

max time kernel
154s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 22:42

Sharing

Report Analysis Logs

General

Target

4106e111fd049fd682adabdb979d7f47.dll
Size

504KB
MD5

4106e111fd049fd682adabdb979d7f47
SHA1

fe2937e8a7f92df765807a8e4a5f3b499bab3758
SHA256

2398a099fef991fd9cb46ff5cfb53bf7b3d0c9f371327dfbb8087d4d17c65889
SHA512

460ee77c2d879e7eb900cafc37e0cb81bc187042c5a185506aa79e1bb706a6f83170fe5d2bca1d25599d5c7c73e0e85e18eaf77377224f11e9e7c1da4c2e6a0b
SSDEEP

12288:OyDRoGHRLA5d+V16qo5g39dZphFq2vdvkZxtRJNO:OF54V3phFgA

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 3796	4100	rundll32.exe	90
PID 4100 wrote to memory of 3796	4100	rundll32.exe	90
PID 4100 wrote to memory of 3796	4100	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4106e111fd049fd682adabdb979d7f47.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4106e111fd049fd682adabdb979d7f47.dll,#1
  2⤵
  PID:3796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads