dcdde4b2899960f3c445afe39f51c7aeac4c8a93e1f2d4735bd41bb3a16fabd3 | Triage

Analysis

max time kernel
94s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 03:28

Sharing

Report Analysis Logs

General

Target

030cbff4bdbac9b1c47e27364b0c6746.dll
Size

56KB
MD5

030cbff4bdbac9b1c47e27364b0c6746
SHA1

398457758ab3b34f1f5fc6c33f4aed642c77de76
SHA256

dcdde4b2899960f3c445afe39f51c7aeac4c8a93e1f2d4735bd41bb3a16fabd3
SHA512

f24423de3e2499036afc2dd3298bfaab3056073c00c4a2694e3e1b8886505e56f61102e0d362ccb8ab18ed62890479a912ee9598953b2b3c493b761bf5f36eb3
SSDEEP

1536:BfQAl+7ovOFE/HdzVgqZfFpGiVpGgBijCcNi67o:dQAl+pFE/HtVxZF3PBiWZSo

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 428 wrote to memory of 1944	428	rundll32.exe	48
PID 428 wrote to memory of 1944	428	rundll32.exe	48
PID 428 wrote to memory of 1944	428	rundll32.exe	48

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\030cbff4bdbac9b1c47e27364b0c6746.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:428
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\030cbff4bdbac9b1c47e27364b0c6746.dll,#1
  2⤵
  PID:1944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1944-0-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download
memory/1944-1-0x0000000002A10000-0x0000000002A11000-memory.dmp

Filesize
4KB

Download