568b7936c3c261e50cdaa536984a17b5bfbb2a221c31b503f62c3151006f58b5 | Triage

Analysis

max time kernel
147s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 03:17

Sharing

Report Analysis Logs

General

Target

02714617f7c023c55cd083e2cac65730.dll
Size

6KB
MD5

02714617f7c023c55cd083e2cac65730
SHA1

25973546a84174ca00871dca60512a7f44a41faf
SHA256

568b7936c3c261e50cdaa536984a17b5bfbb2a221c31b503f62c3151006f58b5
SHA512

c1a1eed2f8cd9d6bd15b5e1e6fe49242fb803a34c358d7d4355f2df3e29aa96781e17502f4b144007c89dcfde3b5cfede7db606d0f3890cf8db48c8b1b1a54f2
SSDEEP

48:6EQt5YVOSVVEPy+wEMmqiHNpU100B+BDq9J5SV3DY:CSVVEPozmB7eB+FqX5S1D

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 2116	1692	rundll32.exe	14
PID 1692 wrote to memory of 2116	1692	rundll32.exe	14
PID 1692 wrote to memory of 2116	1692	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\02714617f7c023c55cd083e2cac65730.dll,#1
1⤵
PID:2116

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\02714617f7c023c55cd083e2cac65730.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads