e0e39a7145c4517c8595b56de56f5cd5ae19d48d4587bcb35045dd9200d2d233 | Triage

Analysis

max time kernel
163s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 03:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

01fc7de1c28d5d7ca6dd69d88becb145.dll
Size

40KB
MD5

01fc7de1c28d5d7ca6dd69d88becb145
SHA1

b284ebb386a1fd57dd419ddb0156849c17eea95b
SHA256

e0e39a7145c4517c8595b56de56f5cd5ae19d48d4587bcb35045dd9200d2d233
SHA512

20d8d588244cfc03f62c468f72de7e4cb42c1213f1fc5f1e98c0398442fcb735ec2df440a8876a9acd01cf5420eb0852d941b3f890c27295e3d1c088ecc8184d
SSDEEP

768:M8H5DegcXRlvJ43ImJWBwj6lpS7jB3FjLovbexO:/DqB43IVwj6mxoSxO

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2976	2228	rundll32.exe	23
PID 2228 wrote to memory of 2976	2228	rundll32.exe	23
PID 2228 wrote to memory of 2976	2228	rundll32.exe	23

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01fc7de1c28d5d7ca6dd69d88becb145.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\01fc7de1c28d5d7ca6dd69d88becb145.dll,#1
  2⤵
  PID:2976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2976-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download