6f88a0cc55c52349b9a3db8fc493cb9ae18b0ec2f726cf9a9d3207b12fcdf616 | Triage

Analysis

max time kernel
91s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 08:12

Sharing

Report Analysis Logs

General

Target

113780d0d45031879b1d5bad24ba675b.dll
Size

6KB
MD5

113780d0d45031879b1d5bad24ba675b
SHA1

8ad0deddf327687bba7d922b32836c06c1914224
SHA256

6f88a0cc55c52349b9a3db8fc493cb9ae18b0ec2f726cf9a9d3207b12fcdf616
SHA512

d04a3358bd37a87b46bced9fbdfe18135655a9e14223418de174ad61b8ef3db5291a86307209e098b2c703e3727171d3ecafeda9e3864c932d0da045f11458b0
SSDEEP

48:6WQV5YVOqtV0H1pw9ygYVUG02KB+BDq9J5SC:8qtV0HAr48B+FqX5SC

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 3640	4932	rundll32.exe	88
PID 4932 wrote to memory of 3640	4932	rundll32.exe	88
PID 4932 wrote to memory of 3640	4932	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\113780d0d45031879b1d5bad24ba675b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\113780d0d45031879b1d5bad24ba675b.dll,#1
  2⤵
  PID:3640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads